CVE-2026-81856

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.0.1 through 2.5.1

Description Improper neutralization of escape, meta, or control sequences allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. The software prints strings from the package repository and documentation search service directly to the terminal via Hex.Shell.info/1 and Hex.Shell.error/1 without neutralizing control characters. This affects package metadata, configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print error result/1. An attacker can embed ANSI escape sequences—such as cursor movement, line erase, carriage returns, and OSC 52 clipboard writes—or Unicode bidirectional overrides to forge displayed URLs, package descriptions, and suggested commands, conceal real output, or write to the clipboard. This can be triggered by any developer running a documentation search that surfaces a malicious package.

Recommendations Update hexpm hex to version 2.5.2 or later using mix local.hex.