Terminal escape sequence injection is an improper neutralization of escape, meta, or control sequences vulnerability in the Hex package manager. An attacker who can publish a package or control the repository can inject ANSI escape codes or Unicode bidirectional control characters into metadata fields that Hex outputs to the terminal. These unescaped sequences can change cursor position, erase output, fabricate URLs, or even write arbitrary data to the clipboard, thereby misleading users. The flaw is an instance of CWE‑150, where the program outputs data without adequately sanitizing control characters.

All releases of the Hex package manager (hexpm:hex) from 0.0.1 up to, but not including, 2.5.2 are impacted. The issue is fixed in Hex 2.5.2 and later, where output from the repository registry and documentation service is now escaped and registry dependency names are validated. Environments that rely on older Hex binaries or consume package metadata from untrusted mirrors remain at risk.

The CVSS score of 2.3 classifies this bug as low severity. The EPSS score of 0.0037 indicates a very low probability of exploitation, and it is not listed in the CISA KEV catalog. Exploitation does not require elevated privileges or authentication; any party that can publish a malicious package or host a hostile repository can inject the control sequences. The attack vector is confined to systems that run Mix commands using the affected Hex binary, so the threat is limited to environments that fetch or trust untrusted package metadata. While it does not compromise system integrity directly, it can deface terminal output, mislead developers, and potentially expose sensitive data via clipboard writes.