CVE-2026-81856
LowCVSS 2.3Summary
Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.
Risk Assessment
Attack can lead to forging displayed URLs, package descriptions, and suggested commands, concealing real output, or writing to the clipboard, potentially facilitating phishing or other social engineering attacks.
Recommendation
Update Hex to 2.5.2 or later. Limit trust in unknown packages and repositories.
Other vulnerabilities in Hex
See all- CVE-2026-96618Low
A vulnerability in the hex library allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. The issue stems from missing size limits on HTTP responses, gzip decompression, and tarball extraction before checksum verification.
- CVE-2026-96612High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. The app label in package requirements is not validated, allowing values like ../../target, leading to directory deletion and file writes outside the project.
- CVE-2026-105668High
A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.
- CVE-2026-105280Medium
Improper validation of integrity check value in hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
- CVE-2026-103503Medium
Improper certificate validation in hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.
Original NVD description (English source)
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs, package descriptions and suggested commands, concealing real output, or writing to the clipboard. No authentication or privileged position is required; only publishing a package. This issue affects hex: from 0.0.1 before 2.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS