CVE-2026-96612 hexpm CVE debrief

Who should care

Defenders responsible for managing dependencies and ensuring secure package installation should assess exposure and prioritize remediation. This includes developers and DevOps teams responsible for managing dependencies and ensuring secure package installation. They should prioritize verifying and updating hex versions to 2.5.2 or later, reviewing dependency management practices, and monitoring for suspicious activity related to dependency fetching and

Why it matters

Defenders should care about CVE-2026-96612 because it allows a malicious package publisher to manipulate directories and extract package files, potentially leading to security issues. Relevant roles include developers and DevOps teams responsible for managing dependencies and ensuring secure package installation. The vulnerability affects hex versions from 0.6.0 before 2.5.2, and defenders should prioritize verifying and updating hex versions, reviewing dependency management practices, and monitoring for suspicious activity.

• Potential deletion of directories outside the project's deps directory
• Potential extraction of package files into unintended locations
• Need for verification of hex versions and dependency management practices
• Possible impact on dependency fetching and package installation processes

Technical summary

A path traversal vulnerability in hex allows a malicious package publisher to delete directories outside the project's deps directory and extract package files into it. This occurs when a developer fetches dependencies using unvalidated dependency app names. The vulnerability affects hex versions from 0.6.0 before 2.5.2. The issue arises from the lack of validation of the app label in the dependency's requirements, which is used to derive the dependency's checkout directory. Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as <

Defensive priority

Defenders should prioritize verifying and updating hex versions to 2.5.2 or later, reviewing dependency management practices, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update hex versions to 2.5.2 or later
• Review dependency management practices to prevent similar vulnerabilities
• Monitor for suspicious activity related to dependency fetching and package installation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on a path traversal vulnerability in hex, allowing a malicious package publisher to delete directories outside the project's deps directory and extract package files into it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.