Elixir Hex CVE-2026-81856

Exploitation requires the victim to invoke a specific Mix task that renders attacker-controlled repository data: mix hex.info, mix hex.package search, mix hex.search, mix hex.user, mix hex.policy, owner/organization listings, publish/sponsor URL output, or any Hex.Utils.print_error_result/1 error body. The attacker must either publish a malicious package the victim then queries, or control a hostile repository server. Limiting factors: the victim must run one of these interactive commands (UI:P), the victim's terminal emulator must interpret ANSI/OSC/bidi control sequences for the effect to land, and the attacker must induce the victim to look up the malicious package or configure Hex against the hostile repo. Impact is limited to output forgery and clipboard writes - no code execution, file access, or privilege gain. Fixed in Hex 2.5.2.

This is a genuinely low-priority issue despite affecting a core ecosystem tool. All exploitation signals point the same direction: the vendor CVSS 4.0 score is 2.3 (Low) with VI:L as the ONLY impact (VC:N/VA:N) - purely an output-integrity/spoofing problem, not code execution, data theft, or denial of service. Exploitation status is 'no public exploit identified at time of analysis' (no CISA KEV listing, no POC reference, no EPSS score provided). The vector requires UI:P (the victim must actively run a Mix hex task) and AT:P (a specific attack requirement - the victim must query the attacker's package or point Hex at a hostile repo), both of which materially reduce real-world likelihood. PR:N is accurate: an attacker only needs to publish a package, requiring no privileged position. There is no conflict between the signals here - low CVSS, no exploitation evidence, and meaningful preconditions all agree this is a hardening/hygiene defect rather than an urgent threat. One caveat: CWE-150 (terminal escape injection) combined with OSC 52 clipboard writes and forged 'suggested commands' can be a stepping stone to social-engineering a developer into running attacker-chosen shell commands, so treat it as a low-severity enabler, not pure cosmetic noise.

An attacker publishes a Hex package whose metadata (description, links, owner/organization names) embeds ANSI escape, carriage-return, OSC 52 clipboard, or Unicode bidi-override sequences. When a developer runs 'mix hex.info <pkg>', 'mix hex.search', or similar, Hex prints those fields verbatim via Hex.Shell.info/error, so the terminal renders forged URLs and suggested install commands, hides real output, or silently loads the clipboard with an attacker-chosen string. No public exploit identified at time of analysis.