Hex writes unverified package tarballs to standard output in mix hex.package fetch
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch. Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output. This issue affects hex: from 0.20.2 before 2.5.2.
CVE-2026-105280
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-105280
hex
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
hex
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex",
"vendor": "hexpm",
"modules": [
"'Elixir.Mix.Tasks.Hex.Package'",
"'Elixir.Hex.SCM'"
],
"product": "hex",
"versions": [
{
"status": "affected",
"version": "0.20.2",
"lessThan": "2.5.2",
"versionType": "semver"
}
],
"packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=repository_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git",
"packageName": "hex",
"programFiles": [
"lib/mix/tasks/hex.package.ex",
"lib/hex/scm.ex"
],
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Mix.Tasks.Hex.Package':run/1"
},
{
"name": "'Elixir.Hex.SCM':fetch/3"
}
]
},
{
"cpes": [
"cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/hexpm/hex",
"vendor": "hexpm",
"modules": [
"'Elixir.Mix.Tasks.Hex.Package'",
"'Elixir.Hex.SCM'"
],
"product": "hex",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "8a14632ca6ba8a8afd2a3f2098bc267c13e13d93",
"status": "unaffected"
},
{
"at": "69489f8b74213f03db10169e6e5407e6d5fee512",
"status": "unaffected"
}
],
"version": "d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c",
"lessThan": "*",
"versionType": "git"
}
],
"packageURL": "pkg:github/hexpm/hex",
"packageName": "hexpm/hex",
"programFiles": [
"lib/mix/tasks/hex.package.ex",
"lib/hex/scm.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Mix.Tasks.Hex.Package':run/1"
},
{
"name": "'Elixir.Hex.SCM':fetch/3"
}
]
}
]- Related CVEs
- CVE-2026-105280
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32875 · Revision 1
- Added to Heist Feed
- Publisher date