CVE-2019-1000012

8.8 highEPSS 0.9%

High (8.8) in hex hex. EPSS 0.9% chance of exploitation in the next 30 days.

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-345
Published: 2019-02-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hex:hex

References

https://github.com/hexpm/hex/pull/646
https://github.com/hexpm/hex/pull/651
https://github.com/hexpm/hex/pull/646
https://github.com/hexpm/hex/pull/651

Check your stack JSON