A vulnerability (CVE-2026-119613) was identified in Ash-project Ashai. The bug allows an attacker to retrieve internal error details, including module names and data values, by inducing a tool call failure. The error information, including potentially sensitive data, is not logged and is instead sent to clients and the model. The fix for this issue logs error messages with a unique ID and returns only the ID to the caller, preventing sensitive information exposure. This issue affects Ashai versions 1.5.0 and earlier.