hexpm vulnerabilities
4 known CVE vulnerabilities in hexpm, translated and rated.
- CVE-2026-75554Low
hexpm (hex.pm) has a vulnerability due to insufficient session expiration in the OAuth token refresh grant. A user removed from an organization can still read private packages because permission scopes are not properly updated. Affects hex.pm from 2025-10-10 before 2026-08-24.
- CVE-2026-75542High
An incorrect authorization vulnerability in the OAuth token endpoint in hexpm allows an API key with the repositories permission to read another organization's private packages. During key exchange for a token, scope validation does not resolve the organization name against the principal, and repository:<name> scope passes through unchanged. The token grants read access to that organization's private packages until expiration.
- CVE-2026-23940Medium
In hexpm/hexpm before commit 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 and hex.pm before 2026-03-10, an uncontrolled resource consumption vulnerability exists. Publishing an oversized package can cause memory exhaustion during tarball extraction, leading to denial of service.
- CVE-2026-21618Medium
hexpm (hex.pm) has a Cross-Site Scripting (XSS) vulnerability in the Elixir.HexpmWeb.SharedAuthorizationView module. The render_grouped_scopes/3 function does not sanitize input, allowing script injection.