CVE-2026-105668
HighCVSS 7.1Summary
A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.
Risk Assessment
An attacker can inject a malicious package release that will be selected during updates, bypassing cooldown protections, potentially leading to project compromise.
Recommendation
Update hex to version 2.5.2 or later. Additionally, consider applying additional package security policies.
Other vulnerabilities in hex
See all- CVE-2026-96618Low
A vulnerability in the hex library allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. The issue stems from missing size limits on HTTP responses, gzip decompression, and tarball extraction before checksum verification.
- CVE-2026-96612High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. The app label in package requirements is not validated, allowing values like ../../target, leading to directory deletion and file writes outside the project.
- CVE-2026-81856Low
Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.
- CVE-2026-105280Medium
Improper validation of integrity check value in hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
- CVE-2026-103503Medium
Improper certificate validation in hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.
Original NVD description (English source)
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected. This issue affects hex: from 2.5.0 before 2.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS