CVE-2026-96612: hex 0.6.0 to before 2.5.2

Affected technology

hex · 0.6.0 to before 2.5.2
hexpm

hex · 380f87054e1bc08ee13d2b5311bc01f98dad2fc6 to before *; status changes: 1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb — unaffected, 72279a8e2004b32b20d8767ff010c117193dd02c — unaffected
hexpm

Component: 'Elixir.Hex.RemoteConverger', 'Elixir.Hex.Mix', 'Elixir.Hex.SCM'
Function: 'Elixir.Hex.RemoteConverger':deps/2, 'Elixir.Hex.RemoteConverger':converge/2, 'Elixir.Hex.Mix':to_lock/1, 'Elixir.Hex.SCM':update/1, 'Elixir.Hex.SCM':checkout/1
File: lib/hex/remote_converger.ex, lib/hex/mix.ex, lib/hex/scm.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.