Hexpm
CVE-2026-21618
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious URL with unescaped payload
-
ExploitUser visits link and clicks authorization prompt
-
ExecutionXSS payload executes in SharedAuthorizationView render_grouped_scopes
-
ImpactAttacker steals session tokens or performs actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Hexpm versions before c692438684ead90c3bcbfb9ccf4e63c768c668a8. User interaction required: victim must click authorization prompt containing unescaped scope parameters in SharedAuthorizationView component. Network-accessible hexpm instance with authorization flow enabled. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Improper input sanitization in hexpm's SharedAuthorizationView module allows unauthenticated attackers to inject malicious scripts into web pages through the render_grouped_scopes function, enabling cross-site scripting (XSS) attacks against hex.pm users. The vulnerability affects hexpm versions from October 2025 through January 19, 2026, and currently has no available patch. Attackers can exploit this via a simple network request requiring only user interaction, potentially compromising user sessions or stealing sensitive data.
Earlier versions of this analysis (1)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS).
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects from 2025-10-01. Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3.
This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3
Know when Hexpm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db) · only source for this CVE.
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3.
This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8, from pkg:github/hexpm/hexpm@617e44c71f1dd9043870205f371d375c5c4d886d before pkg:github/hexpm/hexpm@c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.
Executive ViewAI
CVE-2026-21618 presents significant security risk, a cross-site scripting vulnerability rated CVSS 8.5. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement Content-Security-Policy headers; (2) Enable HttpOnly and SameSite cookie attributes; (3) Deploy WAF XSS/CSRF rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
Insufficient session expiration in hexpm. Password reset tokens never expire, enabling persistent account takeover.
Silent dependency checksum bypass in hexpm/hex package manager (versions 0.16.0 through 2.4.1) allows attackers to subst
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories`
Path traversal in the Hex package manager for the Elixir/Erlang (Mix) ecosystem, versions 0.6.0 through 2.5.1, lets a ma
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protecti
An uncontrolled resource consumption vulnerability in the Hex.pm package manager allows authenticated attackers to cause
Hexpm's OAuth implementation fails to enforce read-only API key restrictions during token exchange, allowing an attacker
Integrity-check bypass in the Hex package manager (hexpm hex) allows a compromised or attacker-controlled package mirror
Path traversal in hexpm's Local Storage backend allows unauthenticated attackers to read sensitive files through relativ
Improper TLS server-certificate validation in hex_core (0.1.0 through versions before 0.20.0) lets an attacker who alrea
Improper certificate validation in Hex (the Elixir/Erlang package manager client, versions 0.20.2 through 2.5.1) allows
Denial of service in Erlang OTP's stdlib erl_tar module (OTP 29.0 before 29.1.2, stdlib 8.0 before 8.1.1) allows an atta
Exploit-DB