CVE-2026-81856: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences in hexpm hex
Description
CVE-2026-81856 is a vulnerability in the hexpm hex package manager allowing malicious package publishers or hostile repository servers to inject terminal control sequences into the output of Mix tasks. This occurs because hex prints strings from the package repository and documentation search service directly to the terminal without neutralizing control characters. Affected outputs include package metadata, search results, user and organization listings, and API error messages. Exploitation requires only publishing a malicious package, with no special privileges or authentication. The vulnerability affects hex versions from 0.0.1 up to but not including 2.5.2. The CVSS 4.0 score is 2.3, indicating low severity.
CVSS v4.0
Score 2.3low
Affected software
hexpm
hex
hexpm
hex
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability is an improper neutralization of escape, meta, or control sequences (CWE-150) in hexpm's hex package manager. Hex outputs strings from package metadata and other sources directly to the terminal via Hex.Shell.info/1 and Hex.Shell.error/1 without sanitizing control characters. This allows a malicious package to embed ANSI escape sequences or Unicode bidirectional overrides that can manipulate terminal display, forge URLs, conceal output, or write to the clipboard. No authentication or privileged access is required; simply publishing a package is sufficient to exploit. The affected versions are >=0.0.1 and <2.5.2.
Potential Impact
An attacker who publishes a malicious package can inject terminal control sequences into the output of Mix tasks, potentially misleading users by forging displayed URLs, package descriptions, suggested commands, or concealing real output. Clipboard writes via OSC 52 sequences are also possible. This could lead to user confusion or social engineering but does not directly compromise system integrity or confidentiality. The low CVSS score reflects the limited impact and required user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when installing or interacting with packages from untrusted sources. Avoid running Mix tasks that display package metadata or search results from untrusted repositories. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-31T00:45:02.431Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd04f82cdf04f656ac9332
Added to database: 10/12/2026, 16:04:08 UTC
Last enriched: 10/12/2026, 16:18:50 UTC
Last updated: 10/12/2026, 18:57:55 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.