Is CVE-2026-96612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96612 being exploited in the wild.

How severe is CVE-2026-96612?

Informational severity, published 12 October 2026.

How is CVE-2026-96612 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96612?

Check whether you run Hexpm Hex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96612: Hex path traversal in unvalidated dependency app names

CVE-2026-96612 · Severity: info · Published 2026-10-12

Hex is a package manager for the Elixir programming language. A malicious package publisher can craft a dependency with a specially crafted app name (like "../../target") that causes developers' dependency fetching tools to delete arbitrary directories and write package files into them. This could enable arbitrary code execution when developers run mix deps.get or mix deps.update before compiling any code.

Technologies: Hexpm Hex. Vendors: Hexpm.

Quick answers

Is CVE-2026-96612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96612 being exploited in the wild.
How severe is CVE-2026-96612?: Informational severity, published 12 October 2026.
Which products and versions are affected?: Hexpm Hex 0.6.0 before 2.5.2.
Is there a fix for CVE-2026-96612?: Yes: fixed in Hex 2.5.2 or later. Until then: Before running mix deps.get on a mix.lock from an untrusted change, verify that every key in mix.lock contains only plain application names without /, \, or .. characters. This workaround does not apply to new dependency resolution with mix deps.update or mix deps.get without a lock entry. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96612 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96612?: Check whether you run Hexpm Hex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Hex 2.5.2 or later

Before running mix deps.get on a mix.lock from an untrusted change, verify that every key in mix.lock contains only plain application names without /, \, or .. characters. This workaround does not apply to new dependency resolution with mix deps.update or mix deps.get without a lock entry.

Technical details

The vulnerability is a path traversal in Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1, and Hex.SCM.update/1. The "app" label from the signed registry is used directly without validation to derive the checkout directory (deps/<app>), then File.rm_rf!/1 deletes that directory and the package is unpacked there. An attacker can set the app label to a value with .. segments to escape the deps directory. This occurs before dependency code is compiled, affecting mix deps.get, mix deps.update, and CI workflows.

Affected products

hexpm Hex 0.6.0 before 2.5.2

Timeline

2026-10-12: disclosed
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.