CVE-2026-96612
HighCVSS 7.5Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. The app label in package requirements is not validated, allowing values like ../../target, leading to directory deletion and file writes outside the project.
Risk Assessment
The risk includes unauthorized deletion of files and directories outside the project, potentially leading to data loss or system integrity compromise.
Recommendation
Upgrade hex to version 2.5.2 or later and implement validation of app labels in packages.
Other vulnerabilities in hex
See all- CVE-2026-96618Low
A vulnerability in the hex library allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. The issue stems from missing size limits on HTTP responses, gzip decompression, and tarball extraction before checksum verification.
- CVE-2026-81856Low
Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.
- CVE-2026-105668High
A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.
- CVE-2026-105280Medium
Improper validation of integrity check value in hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
- CVE-2026-103503Medium
Improper certificate validation in hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled. This issue affects hex: from 0.6.0 before 2.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS