CVE-2026-81856: hex 0.0.1 to before 2.5.2

Affected technology

hex · 0.0.1 to before 2.5.2
hexpm

hex · 211303e3f68f5d3ce06450c1ff1a7a770a9ab236 to before dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8
hexpm

Component: 'Elixir.Mix.Tasks.Hex.Search'
Function: 'Elixir.Mix.Tasks.Hex.Search':run/1
File: lib/mix/tasks/hex.search.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.