CVE-2026-105668: hex 2.5.0 to before 2.5.2

Affected technology

hex · 2.5.0 to before 2.5.2
hexpm

hex · b4e665d46be8a5f81e8cbbe4c3a67058a19cf133 to before *; status changes: eed2bdf85320ae9e244629511c03f5f3f8c5d0b5 — unaffected, 1b6fddfeadd98ed26a143f60356efade0494e2ae — unaffected
hexpm

Component: 'Elixir.Hex.RemoteConverger', 'Elixir.Hex.Registry.Cooldown'
Function: 'Elixir.Hex.RemoteConverger':build_cooldown_bypass/3, 'Elixir.Hex.RemoteConverger':unsafe_lock_bypass/1, 'Elixir.Hex.Registry.Cooldown':versions/2
File: lib/hex/remote_converger.ex, lib/hex/registry/cooldown.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.