A vulnerability (CVE-2026-119613) was found in the ash-project ashai tool. It allows an attacker to read sensitive information by causing a tool call to fail, resulting in internal error details being returned. This included module names and data values. The fix logs these errors with a unique ID and returns only the ID to the caller, preventing sensitive information disclosure. Affected versions are ashai 1.5.0 and earlier, with a fixed version of 1.5.1.