CVE-2026-105274: rebar3 3.9.1 to before 3.27.3; +2 more affected products

Affected technology

rebar3 · 3.9.1 to before 3.27.3
erlang

rebar3 · 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 to before 360838a22f5b3a88c0358207f2923059bcbb3afb
erlang

hex_core · 0.1.0 to before 0.20.0
hexpm

hex_core · fbb6d9de472e5edb8d6fb6b32a91cb266137892e to before ebe25d110717f6a3addba5232cd4a7dc1c76b628
hexpm

hex · 2.1.0 to before 2.5.2
hexpm

hex · 671f695ac548ed01f5828c2a739ecaa942b21007 to before d8b60eee97abb119d525306f048969a217d793a5
hexpm

Component: r3_hex_repo, r3_hex_api, hex_repo, hex_api, hex_safe_binary_to_term, mix_hex_repo, mix_hex_api
Function: r3_hex_repo:get_names/1, r3_hex_repo:get_versions/1, r3_hex_repo:get_package/2, r3_hex_api:request/4, hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2, hex_repo:get_policy/2, hex_api:request/4, hex_safe_binary_to_term:safe_binary_to_term/1, mix_hex_repo:get_names/1, mix_hex_repo:get_versions/1, mix_hex_repo:get_package/2, mix_hex_repo:get_policy/2, mix_hex_api:request/4
File: apps/rebar/src/vendored/r3_hex_repo.erl, apps/rebar/src/vendored/r3_hex_api.erl, src/hex_repo.erl, src/hex_api.erl, src/hex_safe_binary_to_term.erl, src/mix_hex_repo.erl, src/mix_hex_api.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.