CVE-2026-81856
Received Received - Intake

Terminal Control Sequence Injection in Hex Package Manager

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs, package descriptions and suggested commands, concealing real output, or writing to the clipboard. No authentication or privileged position is required; only publishing a package. This issue affects hex: from 0.0.1 before 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-81856
EUVD
EUVD-2026-97512

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hexpm hex 0.0.1
hexpm hex 211303e3f68f5d3ce06450c1ff1a7a770a9ab236

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a terminal escape sequence injection vulnerability in the Hex package manager for Elixir. It allows malicious package publishers or hostile repository servers to inject terminal control sequences into Mix task outputs without authentication. The issue occurs because Hex does not neutralize control characters in strings from package repositories or documentation services, enabling manipulation of terminal output like forging URLs, hiding content, or writing to the clipboard.

Detection Guidance

To detect this vulnerability, check the installed version of Hex on your system by running: mix hex.version. If the version is below 2.5.2, the system is vulnerable. Additionally, monitor terminal output for unexpected behavior like forged URLs or hidden content during Mix tasks such as mix hex.info, mix hex.package search, or mix hex.search.

Impact Analysis

If you run affected Mix tasks in a terminal emulator that interprets ANSI sequences, an attacker could forge displayed URLs, conceal real output, or write to your clipboard via OSC 52 commands. This could trick you into executing malicious commands or exposing sensitive data. The impact is limited to terminal manipulation and does not directly compromise system integrity or confidentiality.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it primarily affects terminal output manipulation rather than data confidentiality, integrity, or availability. The CVSS score of 2.3 (LOW) reflects limited impact on these aspects. However, if terminal output contains sensitive data, manipulation could indirectly lead to compliance issues.

Mitigation Strategies

Immediately upgrade Hex to version 2.5.2 or later using: mix archive.install hex hex 2.5.2. Avoid running Mix tasks with untrusted package sources until patched. Review terminal output for signs of manipulation during package operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart