Improper Certificate Validation in Hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA present in Hex’s bundled CA store to impersonate that host to users who configure a custom CA store through HEX_CACERTS_PATH that does not include that CA. The attack results in a man‑in‑the‑middle scenario where the attacker can intercept or tamper with package downloads while the hostname verification still passes. This weakness is classified as CWE‑295, meaning that certificate chains can be accepted only because of bundled certificates rather than the intended trust store.

The vulnerability affects the Hex package manager from version 0.20.2 up to, but not including, 2.5.2. It applies to the hexpm:hex product for all platforms that use the bundled CA store and can be configured via HEX_CACERTS_PATH. No specific operating system mitigations are listed, but the issue pertains to how Hex handles TLS certificate validation across environments.

The CVSS score of 5.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not present in the CISA KEV catalogue, so the known exploitation likelihood remains uncertain. The attack vector is inferred to be a controlled interception of HTTPS traffic where the attacker can supply a server certificate that chains to a CA in Hex’s bundle. Successful exploitation requires the attacker to maintain the ability to inject or modify traffic and to possess a legitimate certificate issued by a CA known to Hex. This makes the attack contingent on network control rather than local privilege. Given the moderate score and the absence of public exploits, the overall risk is moderate, but remediation is recommended to prevent potential man‑in‑the‑middle attacks.