Vulnerability GHSA-q3cc-rr2c-87r6
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
May 13, 2022 at 01:07 AM UTC
Hex authenticity of signed packages not validated
0.1.0 - 0.3.0
0.1.0 - 0.3.0
Summary
Hex authenticity of signed packages not validated
Details
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 hours ago
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
0.1.0 - 0.19.0 EEF-CVE-2026-103502
0.1.0 - 0.19.0 EEF-CVE-2026-103502
Low Risk
7 months ago
hex_core has Unsafe Deserialization of Erlang Terms
0.1.0 - 0.12.0 GHSA-hx9w-f2w9-9g96
0.1.0 - 0.12.0 GHSA-hx9w-f2w9-9g96
Unknown
7 months ago
Unsafe Deserialization of Erlang Terms in hex_core
0.1.0 - 0.12.0 EEF-CVE-2026-21619
0.1.0 - 0.12.0 EEF-CVE-2026-21619
Impacted packages
Timeline
Published
4 years ago
May 13, 2022 at 01:07 AM UTC
Fixed (0.4.0)
7 years ago
December 30, 2018 at 12:35 PM UTC
Last Modified
10 months ago
December 10, 2025 at 12:31 AM UTC