hex vulnerabilities

3 known vulnerabilities in hex from Hexpm. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  hex: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-96612Oct 12, 2026Hexpm

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches

• 7.1 High severity

  hex: Protection Mechanism Failure

  CVE-2026-105668Oct 12, 2026Hexpm

  Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds

• 7.5 High severity

  hex_core: Uncontrolled Resource Consumption

  CVE-2026-21619Feb 27, 2026Hexpm

  Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is ass