CVE-2026-105280
Received Received - Intake

Improper Integrity Check in Hex Package Manager

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch. Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output. This issue affects hex: from 0.20.2 before 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-105280
EUVD
EUVD-2026-97501

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hexpm hex 0.20.2
hexpm hex d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of integrity check values in the Hex package manager. When using the mix hex.package fetch command with the --output - flag to write tarballs to standard output, Hex fails to verify the tarball's checksums against the registry before writing them. This allows a malicious mirror server to substitute altered tarballs, which are then written to standard output without detection.

Detection Guidance

To detect this vulnerability, check if your Hex version is between 0.20.2 and 2.5.1. Run `mix hex.version` to verify. If using mirrors via HEX_MIRROR_URL or mirror_url, inspect network traffic for altered tarballs by comparing checksums manually. Look for unexpected output when using `--output -` with `mix hex.package fetch`.

Impact Analysis

This vulnerability can lead to downstream tools receiving and processing modified package contents as if they were legitimate releases. Attackers can exploit it by configuring a mirror to serve malicious content before the actual tarball, tricking systems that process standard output into using the altered files.

Compliance Impact

This vulnerability primarily impacts integrity and security of package management, which could indirectly affect compliance with standards like GDPR and HIPAA by enabling unauthorized code execution or data tampering if malicious packages are installed. However, the CVE data does not directly link this issue to specific compliance failures or regulatory impacts.

Mitigation Strategies

Upgrade Hex to version 2.5.2 or later immediately. Avoid using `--output -` with `mix hex.package fetch`; instead, use `--output FILE` to ensure checksum verification. Disable or audit any configured mirrors (HEX_MIRROR_URL) for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart