This vulnerability is a protection mechanism failure (CWE‑693) and a bypass of security enforcement (CWE‑807) that allows the package owner or an attacker who has compromised that account to override the release‑age cooldown. When a locked release is retired or marked with a security advisory, Hex RemoteConverger lifts the cooldown for every version of that package and any package it depends on. Consequently, a malicious release can be published retired, and the next run of mix deps.update will pick the new release regardless of how old it is, even though the cooldown is still configured. The bypass also applies to packages with the same name in other repositories because the check uses only the package name. Packages protected by an organization dependency policy are unaffected.

This issue impacts the Hex package manager from hexpm, affecting all releases from version 2.5.0 up to, but excluding, 2.5.2.

The CVSS score is 7.1, indicating a high‑level risk that a malicious actor could force the adoption of untested releases. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires the attacker to publish or retire a package release, so an attacker must have valid credentials or have compromised the package owner’s account. Once the bypass is triggered, any mix deps.update command will ignore the release‑age cooldown, allowing the package maintainers or developers to install newer releases immediately. The impact is confined to projects that use Hex for dependency resolution and does not directly expose a remote network vulnerability.