CVE-2026-105280
Description
A flaw was found in hex. This vulnerability allows a malicious package mirror to bypass integrity checks and substitute package files, which can lead to arbitrary code execution in downstream build pipelines. When downloading packages directly to standard output, hex fails to verify the archive's checksum against the repository's signed registry. A compromised mirror can exploit this flaw to inject modified files that automated processes unpack without detecting tampering.
Statement
A moderate severity vulnerability was found in hex, the package manager for the Erlang/Elixir ecosystem. When 'mix hex.package fetch PACKAGE VERSION --output -' streams a package to standard output, hex writes the bytes returned by Hex.SCM.fetch/3 without comparing the tarball's inner and outer checksums against the repository's signed registry, a verification that is performed when output is written to a file. A malicious or compromised package mirror configured through HEX_MIRROR_URL or mirror_url can therefore substitute the tarball written to standard output; in addition, diagnostics that hex prints to standard output (bodies of failed HTTP responses and API warnings) can deliver an attacker-controlled archive ahead of the verified tarball. Build pipelines that unpack standard output can consequently extract substituted files without detecting tampering, which can lead to arbitrary code execution. Red Hat rates this flaw moderate severity with a CVSS 3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N), lower than the upstream CVSS 4.0 score of 6.9, mainly because exploitation requires the non-default combination of a configured mirror and standard-output fetching. Within Red Hat's product scope this issue affects the community rust-hex component in Fedora and EPEL; resolution is delegated and a fix is being pursued through the community process.
Mitigation
Avoid streaming fetched packages directly to standard output. Run 'mix hex.package fetch PACKAGE VERSION --output FILE' instead of '--output -' so that hex verifies the tarball's inner and outer checksums against the signed registry; a fetch of altered bytes to a file fails with a checksum mismatch. Configure only trusted mirrors (HEX_MIRROR_URL or mirror_url), and do not pipe or unpack unverified standard output in automated build pipelines. The upstream fix is available in hex 2.5.2; updating to a version containing this fix is recommended when it becomes available through your distribution.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
