hexpm vulnerabilities

Products

• hex 10
• hexpm 8
• hex core 4
• hex.pm 3

Latest hexpm CVEs

Newest publication first

1. CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

   Published 2026-10-14

   Medium·CVSS 5.9 EPSS 0.21%

   Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d...

2. CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.45%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_he...

3. CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output

   Published 2026-10-12

   Low·CVSS 2.3 EPSS 0.43%

   Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository an...

4. CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names

   Published 2026-10-12

   High·CVSS 7.5 EPSS 0.44%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A pac...

5. CVE-2026-105668 Hex release-age cooldown is lifted package-wide when the locked release is retired

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.36%

   Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger th...

6. CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

   Published 2026-10-12

   Medium·CVSS 6.9 EPSS 0.21%

   Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repositor...

7. CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.36%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirro...

8. CVE-2026-103503 Hex trusts its bundled CA certificates when cacerts_path is set

   Published 2026-10-12

   Medium·CVSS 5.9 EPSS 0.21%

   Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves tha...

9. CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

   Published 2026-10-12

   Medium·CVSS 5.9 EPSS 0.24%

   Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when...

10. CVE-2026-86698 Refresh tokens accepted as private repository credentials at the CDN

    Published 2026-09-22

    Low·CVSS 2.3 EPSS 0.43%

    Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refres...

11. CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends

    Published 2026-08-24

    Low·CVSS 2.3 EPSS 0.43%

    Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so...

12. CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

    Published 2026-08-24

    High·CVSS 8.3 EPSS 0.46%

    Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentials grant, validate_sc...

13. CVE-2026-32148 Lockfile checksums not verified in Hex allows dependency integrity bypass

    Published 2026-04-30

    High·CVSS 8.9 EPSS 0.19%

    Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked bui...

14. CVE-2026-23940 Denial of Service via Oversized Package Upload

    Published 2026-03-13

    High·CVSS 7.1 EPSS 0.52%

    Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result i...

15. CVE-2026-21622 Password Reset Tokens Do Not Expire

    Published 2026-03-05

    Critical·CVSS 9.5 EPSS 0.44%

    Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email c...

16. CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access

    Published 2026-03-05

    High·CVSS 7.0 EPSS 0.38%

    Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with read-only permissions (domain: "api", resource: "read") can be escalated to full write access under specific conditions....

17. CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core

    Published 2026-02-27

    Low·CVSS 2.0 EPSS 0.64%

    Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program...

18. CVE-2026-23939 Path Traversal in Local File Store Backend

    Published 2026-02-26

    Medium·CVSS 6.9 EPSS 0.48%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines...

19. CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen

    Published 2026-01-19

    High·CVSS 8.5 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.