Hex, the package manager for the Elixir ecosystem, writes unverified tarball data directly to standard output when a user runs mix hex.package fetch with the - output flag. The integrity checks that normally compare the tarball’s hash against the signed registry data are omitted for this output path, meaning a malicious or compromised mirror can substitute a forged archive that will be emitted unfiltered. If that output is piped into a program that extracts the archive—such as a typical build pipeline—the attacker could supply code that is executed in the user’s environment, leading to arbitrary code execution or tampering of dependencies.

The vulnerability affects the Hexpm Hex package manager from release 0.20.2 up to, but not including, version 2.5.2. Users running release 0.20.2 through 2.5.1 and using mix hex.package fetch with the standard output flag are susceptible. The product is Hexpm's Hex package manager.

The CVSS score of 6.9 indicates a moderate level of risk, although the EPSS score is not available, so the current exploitation likelihood cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers must control or intercept the package mirror to supply altered tarball bytes, or exploit a mirror that returns an error response containing a malicious archive. Because the standard output channel is used, any pipeline that unpacks the data can trigger the exploit. Upgrading to version 2.5.2 or later, which performs checksum verification even when outputting to standard output, mitigates the issue.