Read the docs
TI-2026-71020 Aliases CVE-2026-105280

Hex mix hex.package fetch writes unverified tarballs to stdout

Priority LOW 30CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hex, from 0.20.2 before 2.5.2, skips the integrity check on package tarballs when mix hex.package fetch PACKAGE VERSION --output - writes them to standard output. Hex compares the inner and outer checksums with the signed registry before it writes a tarball to a file, but the standard output branch skips that comparison. A mirror set through HEX_MIRROR_URL or mirror_url can serve altered bytes, which the command prints while exiting successfully. Hex also prints HTTP error bodies and x-hex-message warnings to standard output, so a mirror can send a tar archive ahead of the verified tarball, and a pipeline that unpacks standard output extracts the mirror's files (CWE-354).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch. Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output. This issue affects hex: from 0.20.2 before 2.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed hex (hexpm): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex0.20.2 to before 2.5.22.5.2Patch availableCNA
  • hex Vendorhexpm Affected 0.20.2 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade hex to version 2.5.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA hex (hexpm) Fixed in 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex 2.5.2

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-71017 Path traversal in Hex via unvalidated dependency app namesPriority LOW 35
    • TI-2026-71021 Hex release-age cooldown is lifted when a locked release is retiredPriority LOW 33
    • TI-2026-71019 Improper certificate validation in Hex when cacerts_path is setPriority LOW 26
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-105280
  2. 2026-10-13 Affected versions changed · Red Hat
  3. 2026-10-13 CVSS score added · Red Hat
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-16 CISA SSVC decision points changed

References

Patch 2

Advisory 1

Other 3

  • TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
  • TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot access CVSS 4.0HIGH 8.3
  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
  • TI-2026-52890 Explicit organization scopes survive token refresh after membership ends CVSS 4.0LOW 2.3
  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences