{"schemaVersion":3,"id":"CVE-2026-105280","aliases":["DEBIAN-CVE-2026-105280","UBUNTU-CVE-2026-105280"],"status":"published","duplicateOf":null,"title":null,"description":"Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.\n\nHex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch.\n\nHex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output.\n\nThis issue affects hex: from 0.20.2 before 2.5.2.","dates":{"published":"2026-10-12T15:30:14.126Z","modified":"2026-10-16T17:37:21.498Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.9,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"NVD","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.00195,"percentile":0.08625,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-13T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00195,"percentile":0.08625}],"last30":[{"date":"2026-10-13T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00195,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00195,"percentile":0.08625}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-354","name":"Improper Validation of Integrity Check Value","description":"The product does not validate or incorrectly validates the integrity check values or \"checksums\" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/354.html"}],"affected":[{"vendor":"debian","product":"erlang-hex","name":"erlang-hex","label":"erlang-hex","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/erlang-hex","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"erlang-hex","name":"erlang-hex","label":"erlang-hex","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/erlang-hex","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"hexpm","product":"hex","name":"hex","label":"hex","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.20.2, < 2.5.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c","noFixRecorded":true,"fixedIn":null}],"versionsText":"≥ 0.20.2, < 2.5.2 | ≥ d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c (No fix recorded)","eol":null,"hubHref":"/vendor/hexpm/hex"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-105280.html","label":"cna.erlef.org/cves/CVE-2026-105280.html","hostname":"cna.erlef.org","tags":["Related","REPORT"]},{"url":"https://github.com/hexpm/hex/commit/69489f8b74213f03db10169e6e5407e6d5fee512","label":"github.com/hexpm/hex/commit/69489f8b74213f03db10169e6e5407e6d5fee512","hostname":"github.com","tags":["Patch","REPORT"]},{"url":"https://github.com/hexpm/hex/commit/8a14632ca6ba8a8afd2a3f2098bc267c13e13d93","label":"github.com/hexpm/hex/commit/8a14632ca6ba8a8afd2a3f2098bc267c13e13d93","hostname":"github.com","tags":["Patch","REPORT"]},{"url":"https://github.com/hexpm/hex/commit/d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c","label":"github.com/hexpm/hex/commit/d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c","hostname":"github.com","tags":["Related","REPORT"]},{"url":"https://github.com/hexpm/hex/security/advisories/GHSA-98jr-23pm-vj7c","label":"github.com/hexpm/hex/security/advisories/GHSA-98jr-23pm-vj7c","hostname":"github.com","tags":["Related","Vendor Advisory","REPORT"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-105280","label":"osv.dev/vulnerability/EEF-CVE-2026-105280","hostname":"osv.dev","tags":["Related","REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105280","label":"security-tracker.debian.org/tracker/CVE-2026-105280","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-105280","label":"ubuntu.com/security/CVE-2026-105280","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105280","label":"www.cve.org/CVERecord?id=CVE-2026-105280","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-12T15:30:14.126Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-16T17:37:21.498Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:20:14.416Z","stale":false,"partial":false}}