A malicious package publisher can set the dependency’s application label to a value that resolves outside the project’s deps directory, such as ../../target. When Hex and Mix process the dependency, Mix constructs a path like deps/<app>, deletes that directory with File.rm_rf! and unpacks the package there. This path traversal, identified as CWE‑22, lets the attacker delete arbitrary directories and write files in locations beyond the intended dependency space, potentially corrupting a project’s build environment or overwriting critical files.

The vulnerability is present in Hex versions from 0.6.0 through 2.5.1. It affects all projects using the hexpm hex package manager for Elixir applications. Upgrading to 2.5.2 or later removes the validation issue and restores safe dependency handling.

The CVSS score of 7.5 indicates high severity. The exploitation vector is a supply‑chain attack: an attacker publishes a malicious package to hex.pm, and any developer running mix deps.get (or mix deps.update when the project depends on the package, directly or transitively) will trigger the path traversal. No additional user interaction beyond normal dependency resolution is required, and EPSS is not available, but the lack of KEV listing does not reduce the risk. Given the high impact on the file system and the ease of exploiting through Hex’s normal workflow, the likelihood of abuse is moderate to high in environments that fetch dependencies from untrusted or compromised registries.