Terminal escape sequence injection in Hex via unneutralized server-supplied output
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSeverity
low2.3CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Source guidance available
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
What this means
Hex versions before 2.5.2 are vulnerable to terminal escape sequence injection via unneutralized server-supplied output, allowing malicious package publishers to inject control sequences into terminal output. A malicious package can embed ANSI escape sequences or Unicode bidirectional overrides in certain fields. No authentication is required, only publishing a package.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
hexpm · EEF
hex
1 range
hexpm · EEF
hex
Package identity
pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.0.1 → before 2.5.2
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*hexpm · EEF
hex
1 range
hexpm · EEF
hex
Package identity
pkg:github/hexpm/hexIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
211303e3f68f5d3ce06450c1ff1a7a770a9ab236 → before *
git versions
From dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8: unaffected
From 4a9a865c00add6985e04ce33e9c775df9cf8fc38: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Upgrade Hex to 2.5.2 or later, for example with mix local.hex. Hex then escapes terminal control characters in text from hex.pm and the registry before printing it, and rejects registry dependencies whose package or repository name isn't a valid name.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks.
Hex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs, package descriptions and suggested commands, concealing real output, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects hex: from 0.0.1 before 2.5.2.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-81856View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*From (inclusive): 0.0.1
Before: 2.5.2
Applicability preview
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.2",
"versionStartIncluding": "0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.