Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105280— Hex writes unverified package tarballs to standard output in mix hex.package fetch

Quick assessment

Affected
hexpm hex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hexpm/hex 中的完整性检查值验证不当漏洞 在 hexpm/hex 中存在一个完整性检查值验证不当（Improper Validation of Integrity Check Value）的漏洞。该漏洞允许软件包镜像服务器替换由 命令输出到标准输出的 tarball 压缩包。 Hex 在将获取到的 tarball 写入文件或解压之前，会将其内部和外部校验和与仓库中经过签名的注册表数据进行比对。然而， 命令在将结果写入标准输出的分支中，并未执行该比对操作；同时， 函数本身也不会对 newly download

CVSS 6.9 · Medium EPSS 0.19% · P8

Affected Version Matrix 2

VendorProduct Version RangeStatus
hexpm hex 0.20.2< 2.5.2 affected
d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105280

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hex writes unverified package tarballs to standard output in mix hex.package fetch
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch. Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output. This issue affects hex: from 0.20.2 before 2.5.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hexpm hex 0.20.2 ~ 2.5.2 cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*
hexpm hex d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c ~ * cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-105280

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105280

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-105280 (2)

Vendor Advisories for CVE-2026-105280 (3)

Same Patch Batch · hexpm · 2026-10-12 · 7 CVEs total

CVE-2026-96612 7.5 HIGH Path traversal in Hex via unvalidated dependency app names
CVE-2026-105668 7.1 HIGH Hex release-age cooldown is lifted package-wide when the locked release is retired
CVE-2026-103502 5.9 MEDIUM hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
CVE-2026-103503 5.9 MEDIUM Hex trusts its bundled CA certificates when cacerts_path is set
CVE-2026-81856 2.3 LOW Terminal escape sequence injection in Hex via unneutralized server-supplied output
CVE-2026-96618 2.1 LOW Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

IV. Related Vulnerabilities

Same product: hex
Same vendor: hexpm
Same weakness: CWE-354

V. Comments for CVE-2026-105280

No comments yet

Leave a comment