CVE-2026-96612

Name of the Vulnerable Software and Affected Versions hex versions 0.6.0 through 2.5.1

Description A path traversal issue exists where a malicious package publisher can delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. This occurs because Hex uses an app label from the repository's signed registry as the dependency's application name without proper validation in the Hex.RemoteConverger.deps/2 and Hex.Mix.to lock/1 functions. Mix determines the checkout directory as deps/<app>, and the Hex.SCM.update/1 function executes File.rm rf!/1 on that directory before unpacking the package. Since hex.pm only validates the label's length, a publisher can use values like ../../target to target directories outside the intended scope. This process happens during mix deps.get or mix deps.update before any dependency code is compiled, potentially allowing an attacker to overwrite files in directories the developer's account can write to, which could lead to code execution.

Recommendations Upgrade hex to version 2.5.2 or later using mix local.hex. As a temporary mitigation, before running mix deps.get on a mix.lock from an untrusted source, verify that every key in mix.lock is a plain application name and does not contain /, ``, or .. characters.