{"id":"EEF-CVE-2026-96612","summary":"Path traversal in Hex via unvalidated dependency app names","details":"## Summary\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's `deps` directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an `app` label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (`Hex.RemoteConverger.deps/2`, `Hex.Mix.to_lock/1`). Mix derives the dependency's checkout directory as `deps/\u003capp\u003e`, and `Hex.SCM.update/1` runs `File.rm_rf!/1` on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as `../../target`. When a project depends on such a release directly or transitively, `mix deps.get` or `mix deps.update` deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2.\n\n## Details\n\n1. hex.pm stores each requirement's `app` field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.\n2. `Hex.RemoteConverger.deps/2` returns the dependency's children with `String.to_atom/1` of that label as the application name, and `Hex.Mix.to_lock/1` writes it as the `mix.lock` key.\n3. Mix computes the dependency destination as `Path.join(Mix.Project.deps_path(), Atom.to_string(app))` without validating the name.\n4. `Hex.SCM.update/1` calls `File.rm_rf!(dest)` and then `Hex.Tar.unpack!(path, dest)`, so a label containing `..` segments deletes and repopulates a directory outside `deps`.\n5. Mix doesn't evaluate a Hex dependency's `mix.exs` during `mix deps.get`, so this is reachable before any package code runs.\n\n## Proof of concept\n\n1. Publish package `beta`.\n2. Publish package `alpha` with a requirement on `beta` whose `app` is `../../escape_marker`.\n3. In a project that depends on `alpha`, create `../escape_marker/canary.txt` next to the project directory.\n4. Run `mix deps.get`. Hex prints `* Updating ../../escape_marker (Hex package)`, deletes `canary.txt` and writes `beta`'s files into `../escape_marker`.\n\n## Impact\n\nA publisher of any package in a project's dependency tree can make `mix deps.get` delete a directory that the developer's account can write and that `..` segments relative to `deps` reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run `mix deps.get` or `mix deps.update` are affected.\n\n## Workarounds\n\nBefore running `mix deps.get` on a `mix.lock` from an untrusted change, check that every key in `mix.lock` is a plain application name without `/`, `\\` or `..`. There's no workaround for new dependency resolution with `mix deps.update` or `mix deps.get` without a lock entry.\n\n## Configurations\n\nAffects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency `app` label, when dependencies are fetched with `mix deps.get` or `mix deps.update`. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata.\n\n## Solutions\n\nUpgrade Hex to 2.5.2 or later, for example with `mix local.hex`. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, `_` and `-`, and warns about them. Resolution fails if no other release of the package fits the requirements.","aliases":["CVE-2026-96612","GHSA-2vjj-c5hr-6xc3"],"modified":"2026-10-12T15:56:09.679764779Z","published":"2026-10-12T15:39:49.862Z","database_specific":{"cwe_ids":["CWE-22"],"capec_ids":["CAPEC-126"],"cpe_ids":["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"]},"references":[{"type":"ADVISORY","url":"https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-96612.html"},{"type":"WEB","url":"https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6"},{"type":"FIX","url":"https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb"},{"type":"FIX","url":"https://github.com/hexpm/hex/commit/72279a8e2004b32b20d8767ff010c117193dd02c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hexpm/hex","events":[{"introduced":"380f87054e1bc08ee13d2b5311bc01f98dad2fc6"},{"fixed":"1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb"},{"fixed":"72279a8e2004b32b20d8767ff010c117193dd02c"}]}],"versions":["v2.5.1","v2.5.0","v2.2.2","v2.4.2","v2.4.1","v2.4.0","v2.2.1","v2.2.0","v2.0.6","v2.1.1","v0.21.3","v2.1.0","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.0.1","v1.0.0","v0.21.2","v0.21.1","v0.21.0","v0.20.5","v0.20.4","v0.20.3","v0.20.2","v0.18.2","v0.19.0","v0.16.1","v0.20.1","v0.20.0","v0.18.1","v0.18.0","v0.17.7","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.2","v0.13.1","v0.13.0","v0.12.1","v0.12.0","v0.11.5","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.4","v0.10.3","v0.10.2","v0.10.0","v0.9.0","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.2","v0.6.1","v0.6.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-96612.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Eric Meadows-Jönsson","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}