CVE-2026-81856 is a low-severity vulnerability in hexpm hex versions from 0.0.1 up to but not including 2.5.2. It involves improper neutralization of escape, meta, or control sequences, allowing a malicious package publisher or hostile repository server to inject terminal control sequences into the output of Mix tasks. This can lead to forged terminal output, concealed real output, or clipboard writes without requiring authentication or privileged access.
CVE-2026-96612 is a path traversal vulnerability in hexpm hex affecting versions from 0.6.0 up to but not including 2.5.2. It allows a malicious package publisher to specify a crafted application label that causes the dependency management process to delete and overwrite directories outside the intended deps directory. This occurs because hex does not validate the app label properly and uses it directly to determine the directory path for unpacking packages. The vulnerability can lead to arbitrary directory deletion and file overwriting during dependency fetching or updating.
CVE-2026-105668 is a Protection Mechanism Failure vulnerability in hexpm hex versions 2.5.0 up to but not including 2.5.2. It allows a package owner or an attacker who has compromised the owner's account to bypass the release-age cooldown mechanism, enabling a newly published release to be selected during dependency resolution despite being younger than the configured cooldown period. This bypass occurs because the cooldown bypass check is based solely on package name, affecting packages with the same name across repositories. The vulnerability does not affect cooldowns configured through organization dependency policies.
CVE-2026-105280 is a medium severity vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. It involves improper validation of integrity check values when fetching packages with the command mix hex.package fetch using standard output. This flaw allows a malicious package mirror to substitute altered tarball data that is written to standard output without checksum verification, potentially leading to untrusted content being processed. The vulnerability arises because the standard output branch bypasses the checksum comparison that is otherwise enforced when writing to a file. Additionally, error responses containing tar archives can be written to standard output before checksum verification, enabling extraction of untrusted files if the output is piped to an unpacking tool.
CVE-2026-96618 is a low severity vulnerability in hexpm hex affecting versions from 0.11.2 up to but not including 2.5.2. It involves improper handling of highly compressed data that can lead to excessive memory or disk space consumption when using commands like mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. The vulnerability arises because hex processes untrusted mirrors without limiting the size of compressed or decompressed data, allowing a malicious mirror to cause resource exhaustion. This affects registry, package, docs, and API responses, with some paths lacking size limits or checksum verification. No known exploits are reported, and no official patch information is provided in the input data.
CVE-2026-103503 is an improper certificate validation vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. The issue arises when the software uses a custom CA certificate store (cacerts_path) that excludes a CA present in Hex's bundled CA store. The verification logic incorrectly accepts server certificate chains containing certificates with public keys matching those in the bundled CA store, even if the configured CA store does not trust that CA. Hostname verification remains enforced. This flaw could allow an attacker who intercepts HTTPS connections and possesses a certificate issued by a CA in the bundled store to impersonate a Hex host to users relying on a custom CA store that excludes that CA.
CVE-2026-103502 is an improper certificate validation vulnerability in the hexpm hex_core library affecting versions from 0.1.0 up to but not including 0.20.0. The issue arises because hex_core's default HTTP adapter on Erlang/OTP 24 and OTP 25 (when the OS CA certificates cannot be loaded) does not verify server certificates properly, allowing an attacker who can intercept HTTPS connections to impersonate hex.pm or related repositories. The vulnerability stems from fallback behavior that disables certificate verification without clear documentation or warnings. hex_core 0.11.0 introduced secure SSL defaults for OTP 25+, but earlier versions and certain OTP configurations remain vulnerable. The CVSS 4.0 score is 5.9 (medium severity).
CVE-2026-32148 is a high-severity vulnerability in hexpm hex affecting versions from 0.16.0 before 2.4.2. It involves improper validation of dependency integrity checks due to a type mismatch in the verification logic, causing checksum verification to be skipped silently. This allows an attacker who can influence cached packages or a compromised registry to inject modified dependencies without detection. The mix.lock file is overwritten with attacker-controlled checksum values, erasing evidence of tampering. No official patch or remediation guidance is currently confirmed.
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.
This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.