CVE-2026-81856: Terminal escape sequence injection in Hex via unneutralized server-supplied output
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks.
Hex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.printerrorresult/1. A malicious package can embed ANSI escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs, package descriptions and suggested commands, concealing real output, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects hex: from 0.0.1 before 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hexto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who run Mix tasks that display repository- or documentation-service-supplied Hex data are exposed. This includes commands that show package metadata, search results, owners or organizations, URLs, authenticated usernames, policy identities, configuration snippets, or API error bodies.
What does an attacker need to exploit it?
An attacker needs to publish a malicious package or operate a hostile repository server that supplies crafted strings. No authentication or privileged position is required for a malicious package publisher.
What could successful exploitation do?
Crafted terminal control sequences can forge displayed URLs, package descriptions, or suggested commands; conceal legitimate output; move or erase terminal content; and potentially write data to the clipboard through OSC 52 sequences. Unicode bidirectional overrides can also make displayed text misleading.
How can I tell whether I may already be affected?
Review terminal output from affected Mix tasks for unexpected cursor movement, overwritten or missing text, misleading URLs or commands, unusual bidirectional text, or clipboard changes after viewing package or repository data. The vulnerable behavior occurs when server-supplied strings are printed unchanged through Hex.Shell.info/1, Hex.Shell.error/1, or API error rendering.