CVE-2026-105280: CWE-354 Improper Validation of Integrity Check Value in hexpm hex

The vulnerability arises because hex compares checksums of fetched tarballs only when writing to a file or unpacking, but not when writing to standard output via 'mix hex.package fetch PACKAGE VERSION --output -'. The Hex.SCM.fetch/3 function returns bytes without verifying the tarball's integrity, allowing a mirror configured with HEX_MIRROR_URL or mirror_url to serve altered tarballs that are output and accepted by the command. Furthermore, diagnostic output such as HTTP error bodies or API warnings can include tar archives that are emitted to standard output before checksum verification, enabling extraction of potentially malicious files even if the checksum later fails. This affects hex versions >=0.20.2 and <2.5.2.

An attacker controlling a package mirror can serve altered or malicious tarballs that bypass integrity checks when the package is fetched with the --output - option, potentially leading to execution or extraction of untrusted code. Pipelines that unpack standard output may inadvertently process malicious archives included in error responses or diagnostics. This undermines the trust model of package integrity verification in hex for these specific fetch scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using 'mix hex.package fetch' with the --output - option against untrusted or mirrored repositories. Prefer fetching packages with checksum verification enabled by writing to files or using the --output FILE option. Monitor vendor communications for updates and apply official patches once released.