GHSA-q3cc-rr2c-87r6 CVE-2019-1000013
Hex authenticity of signed packages not validated
- Severity
- 8.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.88%
- Chance of exploitation in the next 30 days. Higher than 59.04% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-345 Insufficient Verification of Data Authenticity
- Fix
0.4.0- Upgrade hex_core to this version or later
Description
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| hex_core | < 0.4.0 |
0.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
hex_core Hex → 0.4.0
- mix
{:hex_core, "~> 0.4.0"} # then: mix deps.update hex_core
Severity breakdown
CVSS 3.0 8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole | Not rated yet | Also affects hex_core |
| EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits | Not rated yet | Also affects hex_core |
| EEF-CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | Not rated yet | Also affects hex_core |
| EEF-CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core | High | Also affects hex_core |
| GHSA-rfpc-qcw5-3pc4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | Medium | Same weakness, CWE-345 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Critical | Same weakness, CWE-345 |
| GHSA-p92p-rxj5-7p2x vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine | High | Same weakness, CWE-345 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-345 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor