Read the docs
TI-2026-71017 Aliases CVE-2026-96612

Path traversal in Hex via unvalidated dependency app names

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hex from 0.6.0 before 2.5.2 uses a dependency release's app label as a directory name without validating it (CWE-22). A malicious package publisher can set the label to a path outside the project's deps directory, so mix deps.get or mix deps.update deletes that target directory and writes the package files there. The attacker only needs to publish such a package that a project depends on, directly or transitively.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled. This issue affects hex: from 0.6.0 before 2.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed hex (hexpm): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex0.6.0 to before 2.5.22.5.2Patch availableCNA
  • hex Vendorhexpm Affected 0.6.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade hex to version 2.5.2 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA hex (hexpm) Fixed in 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex 2.5.2

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-71021 Hex release-age cooldown is lifted when a locked release is retiredPriority LOW 33
    • TI-2026-71020 Hex mix hex.package fetch writes unverified tarballs to stdoutPriority LOW 30
    • TI-2026-71019 Improper certificate validation in Hex when cacerts_path is setPriority LOW 26
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-96612
  2. 2026-10-13 Affected versions changed · Red Hat
  3. 2026-10-13 CVSS score added · Red Hat
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-16 CISA SSVC decision points changed
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-27 Affected versions changed · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-11-04 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 3

  • TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
  • TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot access CVSS 4.0HIGH 8.3
  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
  • TI-2026-52890 Explicit organization scopes survive token refresh after membership ends CVSS 4.0LOW 2.3
  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences