PT-2026-36158 · Hex · Hex

Paul Fleischer · Published 2026-04-30 · Updated 2026-05-05 · CVE-2026-32148

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions hex versions 0.16.0 through 2.4.1

Description Insufficient Verification of Data Authenticity in the Hex.RemoteConverger module allows for a dependency integrity bypass. The Hex.RemoteConverger.verify resolved/2 function fails to execute checksum verification because of a type mismatch: Hex.Utils.lock/1 returns string-based dependency names, whereas the verification logic expects atom-based names. This causes the verification process to be silently skipped. While checksums are validated during the initial download from the registry, discrepancies between the lockfile and resolved dependencies are not detected. An attacker capable of influencing cached packages, such as through local cache poisoning or a compromised registry, could provide modified dependency contents that are accepted without detection, as the mix.lock file is silently updated with the registry's checksums.

Recommendations Update to version 2.4.2.

Exploit

Fix

Weakness Enumeration

CWE-354

CWE-494

Related Identifiers

CVE-2026-32148

GHSA-HMV9-4MFR-M92V

Affected Products

Hex

References · 9

• 🔥 https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v · Exploit
• 🔥 https://osv.dev/vulnerability/EEF-CVE-2026-32148 · Exploit
• https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32148 · Security Note
• https://cna.erlef.org/cves/CVE-2026-32148.html · Note
• https://twitter.com/CVEnew/status/2049939549690986549 · Twitter Post
• https://t.me/cveNotify/162112 · Telegram Post
• https://t.me/CVEtracker/52343 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049956867091071066 · Twitter Post