CVE-2026-105280: hex 0.20.2 to before 2.5.2

Affected technology

hex · 0.20.2 to before 2.5.2
hexpm

hex · d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c to before *; status changes: 8a14632ca6ba8a8afd2a3f2098bc267c13e13d93 — unaffected, 69489f8b74213f03db10169e6e5407e6d5fee512 — unaffected
hexpm

Component: 'Elixir.Mix.Tasks.Hex.Package', 'Elixir.Hex.SCM'
Function: 'Elixir.Mix.Tasks.Hex.Package':run/1, 'Elixir.Hex.SCM':fetch/3
File: lib/mix/tasks/hex.package.ex, lib/hex/scm.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.