CVE-2019-1000012

Name of the Vulnerable Software and Affected Versions Hex package manager versions 0.14.0 through 0.18.2

Description The issue is related to insufficient input validation in the Hex package manager, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by loading packages from a malicious mirror site. The exploitation may result in undetected package modifications, allowing code execution.

Recommendations For Hex package manager versions 0.14.0 through 0.18.2, update to version 0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to packages from untrusted or compromised mirror sites to minimize the risk of exploitation. Avoid using packages from malicious or unknown sources until the issue is resolved.