Skip to content
OpenAdvisories

Vendor

hexpm

19 known vulnerabilities.

Products

hex 10 hexpm 8 hex_core 4 hex.pm 3
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-96612

    Path traversal in Hex via unvalidated dependency app names

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetche…

    hexpm hex erlang-hex erlang-hex Debian Ubuntu
  • High 7.1
    CVE-2026-105668

    Hex release-age cooldown is lifted package-wide when the locked release is retired

    Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withhold…

    hexpm hex erlang-hex erlang-hex Debian Ubuntu
  • High 8.3
    CVE-2026-75542

    OAuth token exchange grants repository scopes for organizations the principal cannot access

    Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentia…

    hexpm hexpm
  • High 8.9
    CVE-2026-32148

    Lockfile checksums not verified in Hex allows dependency integrity bypass

    Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and …

    hexpm hex erlang-hex erlang-hex Debian Ubuntu
  • High 7.1
    CVE-2026-23940

    Denial of Service via Oversized Package Upload

    Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application …

    hexpm hexpm
  • High 7.0
    CVE-2026-21621

    Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access

    Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with read-only permissions (domain: "api", resource: "read") can be escalated to full write access under …

    hexpm hexpm hex.pm
  • High 8.5
    CVE-2026-21618

    Cross-site scripting (XSS) in OAuth Device Authorization screen

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program…

    hexpm hexpm hex.pm