All 7 CVE vulnerabilities found in hex, with AI-generated Chinese analysis, references, and POCs.
Vendor: hexpm
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-81856 | Terminal escape sequence injection in Hex via unneutralized server-supplied output CWE-150 | 2.3 | Low | 2026-10-12 |
| CVE-2026-96612 | Path traversal in Hex via unvalidated dependency app names CWE-22 | 7.5 | High | 2026-10-12 |
| CVE-2026-105668 | Hex release-age cooldown is lifted package-wide when the locked release is retired CWE-693 | 7.1 | High | 2026-10-12 |
| CVE-2026-105280 | Hex writes unverified package tarballs to standard output in mix hex.package fetch CWE-354 | 6.9 | Medium | 2026-10-12 |
| CVE-2026-96618 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror CWE-409 | 2.1 | Low | 2026-10-12 |
| CVE-2026-103503 | Hex trusts its bundled CA certificates when cacerts_path is set CWE-295 | 5.9 | Medium | 2026-10-12 |
| CVE-2026-32148 | Lockfile checksums not verified in Hex allows dependency integrity bypass CWE-354 | 5.5 | - | 2026-04-30 |
All 7 known CVE vulnerabilities affecting hex with full Chinese analysis, references, and POCs where available.