CVE-2026-21618 Hex CVE debrief

Who should care

Users of Hexpm, especially those using versions between 2025-10-01 and 2026-01-19, should be aware of this vulnerability and take necessary actions to protect their systems. This includes updating Hexpm to a version beyond 2026-01-19 and reviewing current configurations to ensure proper input validation and sanitization.

Technical summary

The vulnerability is located in the 'Elixir.HexpmWeb.SharedAuthorizationView' modules, specifically in the 'render_grouped_scopes/3' routine. The affected program files include 'lib/hexpm_web/views/shared_authorization_view.ex'. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. This information is based on the supplied source corpus and official CVE record.

Defensive priority

High priority should be given to updating Hexpm to a version beyond 2026-01-19. Users should also review their current configurations and ensure that proper input validation and sanitization are in place.

Recommended defensive actions

• Update Hexpm to a version beyond 2026-01-19
• Review and enhance input validation and sanitization for web page generation
• Monitor systems for suspicious activity related to this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-01-19T15:15:50.693Z and was last modified on 2026-07-24T15:17:13.543Z. The NVD entry is currently Modified. This information is based on the supplied source corpus. The vulnerability affects hexpm versions from 2025-10-01 before 2026-01-19. Users should verify their systems for potential exposure and take necessary actions.

Official resources