Hexpm Hex vulnerabilities

8 CVEs affecting Hexpm Hex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96596, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-105274, published 2026-10-12. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the…
CVE-2026-96612, published 2026-10-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps…
CVE-2026-81856, published 2026-10-12. Low severity, CVSS 2.3. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into…
CVE-2026-96618, published 2026-10-12. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get,…
CVE-2026-105668, published 2026-10-12. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age…
CVE-2026-105280, published 2026-10-12. Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard…
CVE-2026-103503, published 2026-10-12. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to…
CVE-2026-96596, published 2026-10-14. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3…