Hex CVE-2026-105280

Exploitation requires BOTH: (1) the victim has configured a non-default package mirror via the HEX_MIRROR_URL environment variable or the mirror_url setting, and that mirror is attacker-controlled or compromised; and (2) the victim invokes mix hex.package fetch PACKAGE VERSION --output - and pipes standard output into a process that unpacks the tar. The vulnerable path is specifically the stdout branch, which writes the bytes from Hex.SCM.fetch/3 (and any tar-formatted HTTP error body or x-hex-message diagnostic) without the inner/outer checksum comparison. Limiting factors that reduce real-world risk: the default registry (repo.hex.pm) and the --output FILE path are NOT affected because checksum verification still applies there; active user interaction running the exact stdout-pipe command is required (UI:A); and only hex versions from 0.20.2 up to but excluding 2.5.2 are affected.

This is a genuine but conditionally-gated supply-chain integrity flaw, not a drop-everything emergency. The CVSS 4.0 score of 6.9 (Medium) is driven by high integrity impact (VI:H/SI:H) with zero confidentiality or availability impact (VC:N/VA:N), and crucially carries AT:P (a specific attack requirement) and UI:A (active user interaction) - meaning exploitation is not turnkey. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied (only vendor patch commits, which are fixes, not weaponized POCs), so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is bounded by two stacked preconditions: the victim must have deliberately configured a non-default, attacker-controlled or compromised mirror (HEX_MIRROR_URL / mirror_url), AND must use the specific --output - stdout branch piped into an unpacking process. The default Hex configuration (repo.hex.pm) and the normal --output FILE path are NOT affected because checksum verification still runs there. One conflict to flag: the input tag 'Information Disclosure' contradicts the CVSS vector (VC:N, no confidentiality impact) - this is an integrity/supply-chain substitution issue, not a disclosure issue. Net: treat as a Medium-priority patch for Elixir/Erlang shops that run hex in CI pipelines against custom mirrors; lower priority for everyone on the default registry.

An organization configures a caching package mirror via HEX_MIRROR_URL and a CI pipeline runs mix hex.package fetch somepkg 1.2.3 --output - piped into a tar extractor. A malicious or compromised mirror returns altered tarball bytes - or answers an update-check/registry request with an error body that is itself a tar archive - and Hex writes those unverified bytes to stdout, so the pipeline extracts attacker-controlled files even though the later checksum comparison fails. No public exploit code is known, and the network attack (AV:N) requires the specific stdout-pipe usage pattern (UI:A) and a mirror already in the trust path.