Hex (hexpm) CVE-2026-32148

Exploitation requires the attacker to control or influence package content during dependency resolution - either by (1) writing to the local Hex package cache directory (typically ~/.hex/packages/) on the victim's development machine or CI/CD runner, which requires prior local access or malware deployment, or (2) intercepting and modifying network traffic between the Hex client and hex.pm registry during 'mix deps.get' execution through man-in-the-middle positioning (requires network-level access such as compromised WiFi, DNS hijacking, or BGP manipulation), or (3) compromising upstream Hex registry infrastructure or mirrors to serve malicious packages. The attack window is limited to when developers execute dependency resolution commands (AT:P - Attack Timing: Precise). User must actively invoke Mix commands that trigger dependency fetching (UI:A), such as 'mix deps.get', 'mix deps.update', or initial project setup. The vulnerability does NOT affect builds using pre-existing validated lockfiles without re-resolving dependencies. Organizations using private, integrity-verified Hex mirrors with network egress restrictions significantly reduce attack surface. Exploitation is non-automatable (SSVC: Automatable=no) due to requirement for precise timing coordination and user-initiated dependency resolution.

CVSS 4.0 score of 8.9 reflects high confidentiality, integrity, and availability impact with network attack vector (AV:N), low complexity (AC:L), but requires precise timing (AT:P) and user interaction (UI:A). However, real-world risk requires careful context assessment. SSVC indicates proof-of-concept exists and technical impact is total, but exploitation is NOT automatable - attacker must coordinate cache poisoning or registry compromise with developer dependency installation timing. The attack requires either (1) local cache write access on developer machines or CI/CD systems, or (2) compromise of the Hex registry or mirror infrastructure during package resolution. The CVSS vector's AT:P (Attack Timing: Precise) and UI:A (User Interaction: Active) significantly constrain mass exploitation scenarios. For organizations using private Hex mirrors or with strict network egress controls, risk is lower. For supply chain security contexts where attackers target high-value projects and can conduct sustained infrastructure compromise campaigns, this represents critical risk due to silent failure mode - no error messages alert developers to tampered dependencies. The silent lockfile rewrite erases forensic evidence, making post-compromise detection extremely difficult. Prioritize patching in CI/CD pipelines and developer workstations for projects in regulated or high-security contexts.

An attacker compromises a developer's local package cache directory or injects malicious responses into network traffic between the developer workstation and hex.pm registry (e.g., via DNS spoofing or BGP hijacking). When the developer runs 'mix deps.get', Hex retrieves dependency metadata but the type mismatch causes checksum verification to silently fail. The attacker's modified package (containing backdoored code) is accepted, and mix.lock is automatically rewritten with checksums from the attacker-controlled source, erasing evidence of tampering. The malicious dependency executes during compilation or runtime, achieving supply chain compromise. SSVC indicates proof-of-concept code demonstrating the checksum bypass exists, making exploitation feasible for sophisticated threat actors targeting high-value Elixir projects.