CVE-2026-105280: Hex writes unverified package tarballs to standard output in mix hex.package fetch
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEXMIRRORURL or mirrorurl serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch.
Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output.
This issue affects hex: from 0.20.2 before 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hexpm/hexto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users are exposed when they configure a package mirror through HEX_MIRROR_URL or mirror_url and use mix hex.package fetch with --output -. The practical risk is highest for automation that pipes that standard output directly into an unpacking tool.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to alter responses from, the configured mirror. They must cause the affected command to fetch a package using --output -; no credentials are required by the CVSS vector, but user interaction is required to run or approve the command.
Is the normal file-output fetch path affected?
The described checksum-validation bypass is specific to standard output. Fetching with --output FILE compares the tarball's inner and outer checksums against the signed registry and fails when a checksum mismatch is detected.
What can be done when an immediate update is not possible?
Do not use --output - for package tarballs obtained through a mirror, especially in pipelines that unpack its output. Use --output FILE instead, because that path performs checksum validation before writing or unpacking the tarball.
How can I identify vulnerable workflows?
Look for mix hex.package fetch PACKAGE VERSION --output - in scripts or CI jobs, particularly where its output is piped to an archive extractor. Prioritize workflows with HEX_MIRROR_URL or mirror_url configured, since the issue depends on a mirror serving altered bytes or archive content in an HTTP error response.