Hexpm

Path traversal in Hex via unvalidated dependency app names

OAuth token exchange grants repository scopes for organizations the principal cannot access

Password Reset Tokens Do Not Expire

Hex release-age cooldown is lifted package-wide when the locked release is retired

Unsafe Deserialization of Erlang Terms in hex_core

also in 1 other product

Path Traversal in Local File Store Backend

Hex writes unverified package tarballs to standard output in mix hex.package fetch

Denial of Service via Oversized Package Upload

Lockfile checksums not verified in Hex allows dependency integrity bypass

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

also in 3 other products

Hex trusts its bundled CA certificates when cacerts_path is set

Cross-site scripting (XSS) in OAuth Device Authorization screen

Hexpm: Incorrect Authorization

hex_core decompresses registry and Erlang term API responses without size limits

also in 1 other product

Refresh tokens accepted as private repository credentials at the CDN

Terminal escape sequence injection in Hex via unneutralized server-supplied output

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Explicit organization scopes survive token refresh after membership ends