CVE-2026-32148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32148", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.213Z", "datePublished": "2026-04-30T18:17:03.783Z", "dateUpdated": "2026-11-11T19:17:12.374Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'"], "packageName": "hex", "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "2.4.2", "status": "affected", "version": "0.16.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'"], "packageName": "hexpm/hex", "packageURL": "pkg:github/hexpm/hex", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "d7528c8199a1144511508bf3a6460026a5a14c8e", "status": "affected", "version": "e01576f28c64af9fae6eb17e2dad30f6efcb303c", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.4.2", "versionStartIncluding": "0.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Paul Fleischer"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}], "datePublic": "2026-04-30T18:17:03.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Insufficient Verification of Data Authenticity vulnerability in hexpm hex (<code>Hex.RemoteConverger</code> module) allows dependency integrity bypass via unverified lockfile checksums.</p>\n<p>Hex stores checksums for dependencies in the <code>mix.lock</code> file to ensure reproducible and integrity-checked builds. However, <code>Hex.RemoteConverger.verify_resolved/2</code> never executes checksum verification because the lock data returned by <code>Hex.Utils.lock/1</code> uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.</p>\n<p>An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The <code>mix.lock</code> file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.</p>\n<p>This issue affects hex: from 0.16.0 before 2.4.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (`Hex.RemoteConverger` module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the `mix.lock` file to ensure reproducible and integrity-checked builds. However, `Hex.RemoteConverger.verify_resolved/2` never executes checksum verification because the lock data returned by `Hex.Utils.lock/1` uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The `mix.lock` file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2."}], "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2."}], "impacts": [{"capecId": "CAPEC-185", "descriptions": [{"lang": "en", "value": "CAPEC-185 Malicious Software Download"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.9, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:17:12.374Z"}, "references": [{"name": "Lockfile checksums not verified in Hex allows dependency integrity bypass", "tags": ["vendor-advisory", "related"], "url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v"}, {"name": "EEF CNA record for CVE-2026-32148", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32148.html"}, {"name": "OSV record EEF-CVE-2026-32148", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32148"}, {"name": "Introducing commit e01576f in hexpm/hex", "tags": ["related"], "url": "https://github.com/hexpm/hex/commit/e01576f28c64af9fae6eb17e2dad30f6efcb303c"}, {"name": "Fix commit d7528c8 in hexpm/hex", "tags": ["patch"], "url": "https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e"}], "source": {"discovery": "EXTERNAL"}, "title": "Lockfile checksums not verified in Hex allows dependency integrity bypass"}, "adp": [{"references": [{"url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-30T19:03:06.385106Z", "id": "CVE-2026-32148", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T19:03:24.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32148", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-30T19:03:06.385106Z"}}}], "references": [{"url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T19:03:21.319Z"}}], "cna": {"title": "Lockfile checksums not verified in Hex allows dependency integrity bypass", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Paul Fleischer"}, {"lang": "en", "type": "remediation developer", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-J\u00f6nsson / Hex.pm"}], "impacts": [{"capecId": "CAPEC-185", "descriptions": [{"lang": "en", "value": "CAPEC-185 Malicious Software Download"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "modules": ["'Elixir.Hex.RemoteConverger'"], "product": "hex", "versions": [{"status": "affected", "version": "0.16.0", "lessThan": "2.4.2", "versionType": "semver"}], "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "packageName": "hex", "programFiles": ["lib/hex/remote_converger.ex"], "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}]}, {"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "modules": ["'Elixir.Hex.RemoteConverger'"], "product": "hex", "versions": [{"status": "affected", "version": "e01576f28c64af9fae6eb17e2dad30f6efcb303c", "lessThan": "d7528c8199a1144511508bf3a6460026a5a14c8e", "versionType": "git"}], "packageURL": "pkg:github/hexpm/hex", "packageName": "hexpm/hex", "programFiles": ["lib/hex/remote_converger.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}]}], "datePublic": "2026-04-30T18:17:03.000Z", "references": [{"url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v", "name": "Lockfile checksums not verified in Hex allows dependency integrity bypass", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32148.html", "name": "EEF CNA record for CVE-2026-32148", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32148", "name": "OSV record EEF-CVE-2026-32148", "tags": ["related"]}, {"url": "https://github.com/hexpm/hex/commit/e01576f28c64af9fae6eb17e2dad30f6efcb303c", "name": "Introducing commit e01576f in hexpm/hex", "tags": ["related"]}, {"url": "https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e", "name": "Fix commit d7528c8 in hexpm/hex", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient Verification of Data Authenticity vulnerability in hexpm hex (<code>Hex.RemoteConverger</code> module) allows dependency integrity bypass via unverified lockfile checksums.</p>\n<p>Hex stores checksums for dependencies in the <code>mix.lock</code> file to ensure reproducible and integrity-checked builds. However, <code>Hex.RemoteConverger.verify_resolved/2</code> never executes checksum verification because the lock data returned by <code>Hex.Utils.lock/1</code> uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.</p>\n<p>An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The <code>mix.lock</code> file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.</p>\n<p>This issue affects hex: from 0.16.0 before 2.4.2.</p>", "base64": false}, {"type": "text/markdown", "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (`Hex.RemoteConverger` module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the `mix.lock` file to ensure reproducible and integrity-checked builds. However, `Hex.RemoteConverger.verify_resolved/2` never executes checksum verification because the lock data returned by `Hex.Utils.lock/1` uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The `mix.lock` file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.4.2", "versionStartIncluding": "0.16.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:17:12.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32148", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:17:12.374Z", "dateReserved": "2026-03-10T22:37:29.213Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-30T18:17:03.783Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'"], "packageName": "hex", "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "2.4.2", "status": "affected", "version": "0.16.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'"], "packageName": "hexpm/hex", "packageURL": "pkg:github/hexpm/hex", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':verify_resolved/2"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "d7528c8199a1144511508bf3a6460026a5a14c8e", "status": "affected", "version": "e01576f28c64af9fae6eb17e2dad30f6efcb303c", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hex:hex:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7D2A388-56D7-4B82-85AB-6B7C22A6AC18", "versionEndExcluding": "2.4.2", "versionStartIncluding": "0.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.\n\nHex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.\n\nAn attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.\n\nThis issue affects hex: from 0.16.0 before 2.4.2."}, {"lang": "es", "value": "Vulnerabilidad de verificaci\u00f3n insuficiente de la autenticidad de los datos en hexpm hex (m\u00f3dulo Hex.RemoteConverger) permite el bypass de la integridad de las dependencias a trav\u00e9s de sumas de verificaci\u00f3n de archivos de bloqueo no verificadas.\n\nHex almacena sumas de verificaci\u00f3n para las dependencias en el archivo mix.lock para asegurar compilaciones reproducibles y con integridad verificada. Sin embargo, Hex.RemoteConverger.verify_resolved/2 nunca ejecuta la verificaci\u00f3n de la suma de verificaci\u00f3n porque los datos de bloqueo devueltos por Hex.Utils.lock/1 utilizan nombres de dependencia basados en cadenas, mientras que la l\u00f3gica de verificaci\u00f3n compara con nombres basados en \u00e1tomos. Esta falta de coincidencia de tipos hace que la ruta del c\u00f3digo de verificaci\u00f3n se omita silenciosamente. Las sumas de verificaci\u00f3n a\u00fan se validan cuando los paquetes se descargan inicialmente del registro, pero las discrepancias entre el archivo de bloqueo y las dependencias resueltas no se detectan.\n\nUn atacante que puede influir en los paquetes en cach\u00e9 (por ejemplo, a trav\u00e9s de envenenamiento de cach\u00e9 local o un registro comprometido) puede proporcionar contenidos de dependencia modificados que ser\u00e1n aceptados sin detecci\u00f3n. El archivo mix.lock se reescribe silenciosamente con los valores de suma de verificaci\u00f3n del registro, borrando la evidencia de manipulaci\u00f3n.\n\nEste problema afecta a hex: desde 0.16.0 antes de 2.4.2."}], "id": "CVE-2026-32148", "lastModified": "2026-11-11T20:17:09.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32148", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-30T19:03:06.385106Z", "version": "2.0.3"}}]}, "published": "2026-04-30T19:16:09.000", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-32148.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/hexpm/hex/commit/e01576f28c64af9fae6eb17e2dad30f6efcb303c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32148"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}, {"lang": "en", "value": "CWE-494"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.16.0,2.4.2)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hex", "source": "cna", "vendor": "hexpm"}, "product": "hex", "vendor": "hexpm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e01576f28c64af9fae6eb17e2dad30f6efcb303c,d7528c8199a1144511508bf3a6460026a5a14c8e)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hex", "source": "cna", "vendor": "hexpm"}, "product": "hex", "vendor": "hexpm"}], "created": "2026-04-30T21:00:14.309334+00:00", "updated": "2026-05-01T05:15:09.658023+00:00", "vendors": ["hexpm", "hexpm$PRODUCT$hex"]}