CVE-2026-105280— Hex mix hex.package fetch 未验证包输出漏洞
一分钟漏洞结论
影响对象
hexpm hex
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
hexpm/hex 中的完整性检查值验证不当漏洞 在 hexpm/hex 中存在一个完整性检查值验证不当（Improper Validation of Integrity Check Value）的漏洞。该漏洞允许软件包镜像服务器替换由 命令输出到标准输出的 tarball 压缩包。 Hex 在将获取到的 tarball 写入文件或解压之前，会将其内部和外部校验和与仓库中经过签名的注册表数据进行比对。然而， 命令在将结果写入标准输出的分支中，并未执行该比对操作；同时， 函数本身也不会对 newly download
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-105280 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Hex writes unverified package tarballs to standard output in mix hex.package fetch
来源: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch.
Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output.
This issue affects hex: from 0.20.2 before 2.5.2.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-105280 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-105280 的情报信息
请登录查看更多情报信息。
CVE-2026-105280 补丁与修复 (2)
CVE-2026-105280 厂商安全公告 (3)
同批安全公告 · hexpm · 2026-10-12 · 共 7 条
| CVE-2026-96612 | 7.5 HIGH | Hex 通过未验证的依赖应用名实现路径遍历漏洞 |
| CVE-2026-105668 | 7.1 HIGH | Hex 发布年龄冷却包级提升漏洞 |
| CVE-2026-103502 | 5.9 MEDIUM | hex_core默认HTTP适配器未验证TLS证书（OTP 24/25） |
| CVE-2026-103503 | 5.9 MEDIUM | Hex cacerts_path 配置信任捆绑CA证书漏洞 |
| CVE-2026-81856 | 2.3 LOW | Hex 终端转义序列注入漏洞 |
| CVE-2026-96618 | 2.1 LOW | Hex内存与磁盘耗尽漏洞（过大或压缩响应） |
IV. Related Vulnerabilities
V. Comments for CVE-2026-105280
暂无评论