CVE-2026-96612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96612", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-01T09:00:02.103Z", "datePublished": "2026-10-12T15:39:49.862Z", "dateUpdated": "2026-11-11T13:28:28.140Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "packageName": "hex", "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "2.5.2", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "packageName": "hexpm/hex", "packageURL": "pkg:github/hexpm/hex", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"changes": [{"at": "1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb", "status": "unaffected"}, {"at": "72279a8e2004b32b20d8767ff010c117193dd02c", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "380f87054e1bc08ee13d2b5311bc01f98dad2fc6", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency <code>app</code> label, when dependencies are fetched with <code>mix deps.get</code> or <code>mix deps.update</code>. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata.</p>"}, {"base64": false, "type": "text/markdown", "value": "Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency `app` label, when dependencies are fetched with `mix deps.get` or `mix deps.update`. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata."}], "value": "Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency app label, when dependencies are fetched with mix deps.get or mix deps.update. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.5.2", "versionStartIncluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-10-07T22:03:18.000Z", "datePublic": "2026-10-12T15:39:50.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's <code>deps</code> directory and extract package files into it when a developer fetches dependencies.</p>\n<p>A package release's requirements carry an <code>app</code> label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (<code>Hex.RemoteConverger.deps/2</code>, <code>Hex.Mix.to_lock/1</code>). Mix derives the dependency's checkout directory as <code>deps/&lt;app&gt;</code>, and <code>Hex.SCM.update/1</code> runs <code>File.rm_rf!/1</code> on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as <code>../../target</code>. When a project depends on such a release directly or transitively, <code>mix deps.get</code> or <code>mix deps.update</code> deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.</p>\n<p>This issue affects hex: from 0.6.0 before 2.5.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's `deps` directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an `app` label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (`Hex.RemoteConverger.deps/2`, `Hex.Mix.to_lock/1`). Mix derives the dependency's checkout directory as `deps/<app>`, and `Hex.SCM.update/1` runs `File.rm_rf!/1` on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as `../../target`. When a project depends on such a release directly or transitively, `mix deps.get` or `mix deps.update` deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2."}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A publisher of any package in a project's dependency tree can make <code>mix deps.get</code> delete a directory that the developer's account can write and that <code>..</code> segments relative to <code>deps</code> reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run <code>mix deps.get</code> or <code>mix deps.update</code> are affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "A publisher of any package in a project's dependency tree can make `mix deps.get` delete a directory that the developer's account can write and that `..` segments relative to `deps` reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run `mix deps.get` or `mix deps.update` are affected."}], "value": "A publisher of any package in a project's dependency tree can make mix deps.get delete a directory that the developer's account can write and that .. segments relative to deps reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run mix deps.get or mix deps.update are affected."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T13:28:28.140Z"}, "references": [{"name": "GitHub Advisory", "tags": ["related", "vendor-advisory"], "url": "https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3"}, {"name": "EEF CNA record for CVE-2026-96612", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-96612.html"}, {"name": "OSV record EEF-CVE-2026-96612", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-96612"}, {"name": "Introducing commit 380f870 in hexpm/hex", "tags": ["related"], "url": "https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6"}, {"name": "Fix commit 1b3e2ae in hexpm/hex", "tags": ["patch"], "url": "https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb"}, {"name": "Fix commit 72279a8 in hexpm/hex", "tags": ["patch"], "url": "https://github.com/hexpm/hex/commit/72279a8e2004b32b20d8767ff010c117193dd02c"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Upgrade Hex to 2.5.2 or later, for example with <code>mix local.hex</code>. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, <code>_</code> and <code>-</code>, and warns about them. Resolution fails if no other release of the package fits the requirements.</p>"}, {"base64": false, "type": "text/markdown", "value": "Upgrade Hex to 2.5.2 or later, for example with `mix local.hex`. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, `_` and `-`, and warns about them. Resolution fails if no other release of the package fits the requirements."}], "value": "Upgrade Hex to 2.5.2 or later, for example with mix local.hex. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, _ and -, and warns about them. Resolution fails if no other release of the package fits the requirements."}], "source": {"discovery": "UNKNOWN"}, "title": "Path traversal in Hex via unvalidated dependency app names", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Before running <code>mix deps.get</code> on a <code>mix.lock</code> from an untrusted change, check that every key in <code>mix.lock</code> is a plain application name without <code>/</code>, <code>\\</code> or <code>..</code>. There's no workaround for new dependency resolution with <code>mix deps.update</code> or <code>mix deps.get</code> without a lock entry.</p>"}, {"base64": false, "type": "text/markdown", "value": "Before running `mix deps.get` on a `mix.lock` from an untrusted change, check that every key in `mix.lock` is a plain application name without `/`, `\\` or `..`. There's no workaround for new dependency resolution with `mix deps.update` or `mix deps.get` without a lock entry."}], "value": "Before running mix deps.get on a mix.lock from an untrusted change, check that every key in mix.lock is a plain application name without /, \\ or ... There's no workaround for new dependency resolution with mix deps.update or mix deps.get without a lock entry."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>Publish package <code>beta</code>.</li>\n<li>Publish package <code>alpha</code> with a requirement on <code>beta</code> whose <code>app</code> is <code>../../escape_marker</code>.</li>\n<li>In a project that depends on <code>alpha</code>, create <code>../escape_marker/canary.txt</code> next to the project directory.</li>\n<li>Run <code>mix deps.get</code>. Hex prints <code>* Updating ../../escape_marker (Hex package)</code>, deletes <code>canary.txt</code> and writes <code>beta</code>'s files into <code>../escape_marker</code>.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. Publish package `beta`.\n2. Publish package `alpha` with a requirement on `beta` whose `app` is `../../escape_marker`.\n3. In a project that depends on `alpha`, create `../escape_marker/canary.txt` next to the project directory.\n4. Run `mix deps.get`. Hex prints `* Updating ../../escape_marker (Hex package)`, deletes `canary.txt` and writes `beta`'s files into `../escape_marker`."}], "value": "* Publish package beta.\n* Publish package alpha with a requirement on beta whose app is ../../escape_marker.\n* In a project that depends on alpha, create ../escape_marker/canary.txt next to the project directory.\n* Run mix deps.get. Hex prints * Updating ../../escape_marker (Hex package), deletes canary.txt and writes beta's files into ../escape_marker."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>hex.pm stores each requirement's <code>app</code> field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.</li>\n<li><code>Hex.RemoteConverger.deps/2</code> returns the dependency's children with <code>String.to_atom/1</code> of that label as the application name, and <code>Hex.Mix.to_lock/1</code> writes it as the <code>mix.lock</code> key.</li>\n<li>Mix computes the dependency destination as <code>Path.join(Mix.Project.deps_path(), Atom.to_string(app))</code> without validating the name.</li>\n<li><code>Hex.SCM.update/1</code> calls <code>File.rm_rf!(dest)</code> and then <code>Hex.Tar.unpack!(path, dest)</code>, so a label containing <code>..</code> segments deletes and repopulates a directory outside <code>deps</code>.</li>\n<li>Mix doesn't evaluate a Hex dependency's <code>mix.exs</code> during <code>mix deps.get</code>, so this is reachable before any package code runs.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. hex.pm stores each requirement's `app` field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.\n2. `Hex.RemoteConverger.deps/2` returns the dependency's children with `String.to_atom/1` of that label as the application name, and `Hex.Mix.to_lock/1` writes it as the `mix.lock` key.\n3. Mix computes the dependency destination as `Path.join(Mix.Project.deps_path(), Atom.to_string(app))` without validating the name.\n4. `Hex.SCM.update/1` calls `File.rm_rf!(dest)` and then `Hex.Tar.unpack!(path, dest)`, so a label containing `..` segments deletes and repopulates a directory outside `deps`.\n5. Mix doesn't evaluate a Hex dependency's `mix.exs` during `mix deps.get`, so this is reachable before any package code runs."}], "value": "* hex.pm stores each requirement's app field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.\n* Hex.RemoteConverger.deps/2 returns the dependency's children with String.to_atom/1 of that label as the application name, and Hex.Mix.to_lock/1 writes it as the mix.lock key.\n* Mix computes the dependency destination as Path.join(Mix.Project.deps_path(), Atom.to_string(app)) without validating the name.\n* Hex.SCM.update/1 calls File.rm_rf!(dest) and then Hex.Tar.unpack!(path, dest), so a label containing .. segments deletes and repopulates a directory outside deps.\n* Mix doesn't evaluate a Hex dependency's mix.exs during mix deps.get, so this is reachable before any package code runs."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T17:41:34.850974Z", "id": "CVE-2026-96612", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:41:58.545Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96612", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T17:41:34.850974Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:41:45.839Z"}}], "cna": {"title": "Path traversal in Hex via unvalidated dependency app names", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "A publisher of any package in a project's dependency tree can make mix deps.get delete a directory that the developer's account can write and that .. segments relative to deps reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run mix deps.get or mix deps.update are affected.", "supportingMedia": [{"type": "text/html", "value": "<p>A publisher of any package in a project's dependency tree can make <code>mix deps.get</code> delete a directory that the developer's account can write and that <code>..</code> segments relative to <code>deps</code> reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run <code>mix deps.get</code> or <code>mix deps.update</code> are affected.</p>", "base64": false}, {"type": "text/markdown", "value": "A publisher of any package in a project's dependency tree can make `mix deps.get` delete a directory that the developer's account can write and that `..` segments relative to `deps` reach, such as the project directory or its parent, and fill it with the labelled package's files. Writing attacker-chosen files into a directory whose contents are later run or loaded can lead to code execution without the developer compiling the dependency. Developers who fetch dependencies to review them before compiling, CI jobs and dependency update bots that only run `mix deps.get` or `mix deps.update` are affected.", "base64": false}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "product": "hex", "versions": [{"status": "affected", "version": "0.6.0", "lessThan": "2.5.2", "versionType": "semver"}], "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "packageName": "hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}]}, {"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "product": "hex", "versions": [{"status": "affected", "changes": [{"at": "1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb", "status": "unaffected"}, {"at": "72279a8e2004b32b20d8767ff010c117193dd02c", "status": "unaffected"}], "version": "380f87054e1bc08ee13d2b5311bc01f98dad2fc6", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/hexpm/hex", "packageName": "hexpm/hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}]}], "solutions": [{"lang": "en", "value": "Upgrade Hex to 2.5.2 or later, for example with mix local.hex. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, _ and -, and warns about them. Resolution fails if no other release of the package fits the requirements.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade Hex to 2.5.2 or later, for example with <code>mix local.hex</code>. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, <code>_</code> and <code>-</code>, and warns about them. Resolution fails if no other release of the package fits the requirements.</p>", "base64": false}, {"type": "text/markdown", "value": "Upgrade Hex to 2.5.2 or later, for example with `mix local.hex`. Hex then skips package releases that give a dependency an application name other than a letter followed by letters, digits, `_` and `-`, and warns about them. Resolution fails if no other release of the package fits the requirements.", "base64": false}]}], "datePublic": "2026-10-12T15:39:50.000Z", "references": [{"url": "https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3", "name": "GitHub Advisory", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-96612.html", "name": "EEF CNA record for CVE-2026-96612", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-96612", "name": "OSV record EEF-CVE-2026-96612", "tags": ["related"]}, {"url": "https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6", "name": "Introducing commit 380f870 in hexpm/hex", "tags": ["related"]}, {"url": "https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb", "name": "Fix commit 1b3e2ae in hexpm/hex", "tags": ["patch"]}, {"url": "https://github.com/hexpm/hex/commit/72279a8e2004b32b20d8767ff010c117193dd02c", "name": "Fix commit 72279a8 in hexpm/hex", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Before running mix deps.get on a mix.lock from an untrusted change, check that every key in mix.lock is a plain application name without /, \\ or ... There's no workaround for new dependency resolution with mix deps.update or mix deps.get without a lock entry.", "supportingMedia": [{"type": "text/html", "value": "<p>Before running <code>mix deps.get</code> on a <code>mix.lock</code> from an untrusted change, check that every key in <code>mix.lock</code> is a plain application name without <code>/</code>, <code>\\</code> or <code>..</code>. There's no workaround for new dependency resolution with <code>mix deps.update</code> or <code>mix deps.get</code> without a lock entry.</p>", "base64": false}, {"type": "text/markdown", "value": "Before running `mix deps.get` on a `mix.lock` from an untrusted change, check that every key in `mix.lock` is a plain application name without `/`, `\\` or `..`. There's no workaround for new dependency resolution with `mix deps.update` or `mix deps.get` without a lock entry.", "base64": false}]}], "dateAssigned": "2026-10-07T22:03:18.000Z", "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's <code>deps</code> directory and extract package files into it when a developer fetches dependencies.</p>\n<p>A package release's requirements carry an <code>app</code> label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (<code>Hex.RemoteConverger.deps/2</code>, <code>Hex.Mix.to_lock/1</code>). Mix derives the dependency's checkout directory as <code>deps/&lt;app&gt;</code>, and <code>Hex.SCM.update/1</code> runs <code>File.rm_rf!/1</code> on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as <code>../../target</code>. When a project depends on such a release directly or transitively, <code>mix deps.get</code> or <code>mix deps.update</code> deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.</p>\n<p>This issue affects hex: from 0.6.0 before 2.5.2.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's `deps` directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an `app` label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (`Hex.RemoteConverger.deps/2`, `Hex.Mix.to_lock/1`). Mix derives the dependency's checkout directory as `deps/<app>`, and `Hex.SCM.update/1` runs `File.rm_rf!/1` on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as `../../target`. When a project depends on such a release directly or transitively, `mix deps.get` or `mix deps.update` deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory"}]}], "configurations": [{"lang": "en", "value": "Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency app label, when dependencies are fetched with mix deps.get or mix deps.update. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata.", "supportingMedia": [{"type": "text/html", "value": "<p>Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency <code>app</code> label, when dependencies are fetched with <code>mix deps.get</code> or <code>mix deps.update</code>. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata.</p>", "base64": false}, {"type": "text/markdown", "value": "Affects projects whose dependency tree, directly or transitively, contains a package release whose registry metadata carries a crafted dependency `app` label, when dependencies are fetched with `mix deps.get` or `mix deps.update`. Packages on hex.pm are affected while hex.pm accepts such labels; packages on self-hosted repositories are affected when the repository operator signs such metadata.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.5.2", "versionStartIncluding": "0.6.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T13:28:28.140Z"}, "x_proofOfConcept": [{"lang": "en", "value": "* Publish package beta.\n* Publish package alpha with a requirement on beta whose app is ../../escape_marker.\n* In a project that depends on alpha, create ../escape_marker/canary.txt next to the project directory.\n* Run mix deps.get. Hex prints * Updating ../../escape_marker (Hex package), deletes canary.txt and writes beta's files into ../escape_marker.", "supportingMedia": [{"type": "text/html", "value": "<ol>\n<li>Publish package <code>beta</code>.</li>\n<li>Publish package <code>alpha</code> with a requirement on <code>beta</code> whose <code>app</code> is <code>../../escape_marker</code>.</li>\n<li>In a project that depends on <code>alpha</code>, create <code>../escape_marker/canary.txt</code> next to the project directory.</li>\n<li>Run <code>mix deps.get</code>. Hex prints <code>* Updating ../../escape_marker (Hex package)</code>, deletes <code>canary.txt</code> and writes <code>beta</code>'s files into <code>../escape_marker</code>.</li>\n</ol>", "base64": false}, {"type": "text/markdown", "value": "1. Publish package `beta`.\n2. Publish package `alpha` with a requirement on `beta` whose `app` is `../../escape_marker`.\n3. In a project that depends on `alpha`, create `../escape_marker/canary.txt` next to the project directory.\n4. Run `mix deps.get`. Hex prints `* Updating ../../escape_marker (Hex package)`, deletes `canary.txt` and writes `beta`'s files into `../escape_marker`.", "base64": false}]}], "x_technicalAnalysis": [{"lang": "en", "value": "* hex.pm stores each requirement's app field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.\n* Hex.RemoteConverger.deps/2 returns the dependency's children with String.to_atom/1 of that label as the application name, and Hex.Mix.to_lock/1 writes it as the mix.lock key.\n* Mix computes the dependency destination as Path.join(Mix.Project.deps_path(), Atom.to_string(app)) without validating the name.\n* Hex.SCM.update/1 calls File.rm_rf!(dest) and then Hex.Tar.unpack!(path, dest), so a label containing .. segments deletes and repopulates a directory outside deps.\n* Mix doesn't evaluate a Hex dependency's mix.exs during mix deps.get, so this is reachable before any package code runs.", "supportingMedia": [{"type": "text/html", "value": "<ol>\n<li>hex.pm stores each requirement's <code>app</code> field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.</li>\n<li><code>Hex.RemoteConverger.deps/2</code> returns the dependency's children with <code>String.to_atom/1</code> of that label as the application name, and <code>Hex.Mix.to_lock/1</code> writes it as the <code>mix.lock</code> key.</li>\n<li>Mix computes the dependency destination as <code>Path.join(Mix.Project.deps_path(), Atom.to_string(app))</code> without validating the name.</li>\n<li><code>Hex.SCM.update/1</code> calls <code>File.rm_rf!(dest)</code> and then <code>Hex.Tar.unpack!(path, dest)</code>, so a label containing <code>..</code> segments deletes and repopulates a directory outside <code>deps</code>.</li>\n<li>Mix doesn't evaluate a Hex dependency's <code>mix.exs</code> during <code>mix deps.get</code>, so this is reachable before any package code runs.</li>\n</ol>", "base64": false}, {"type": "text/markdown", "value": "1. hex.pm stores each requirement's `app` field with only a length check (255 codepoints) and copies it into the signed package registry resource when it differs from the dependency's package name.\n2. `Hex.RemoteConverger.deps/2` returns the dependency's children with `String.to_atom/1` of that label as the application name, and `Hex.Mix.to_lock/1` writes it as the `mix.lock` key.\n3. Mix computes the dependency destination as `Path.join(Mix.Project.deps_path(), Atom.to_string(app))` without validating the name.\n4. `Hex.SCM.update/1` calls `File.rm_rf!(dest)` and then `Hex.Tar.unpack!(path, dest)`, so a label containing `..` segments deletes and repopulates a directory outside `deps`.\n5. Mix doesn't evaluate a Hex dependency's `mix.exs` during `mix deps.get`, so this is reachable before any package code runs.", "base64": false}]}]}}, "cveMetadata": {"cveId": "CVE-2026-96612", "state": "PUBLISHED", "dateUpdated": "2026-11-11T13:28:28.140Z", "dateReserved": "2026-10-01T09:00:02.103Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-10-12T15:39:49.862Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "packageName": "hex", "packageURL": "pkg:otp/hex?repository_url=https:%2F%2Fgithub.com%2Fhexpm%2Fhex&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fhexpm%2Fhex.git", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"lessThan": "2.5.2", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Hex.RemoteConverger'", "'Elixir.Hex.Mix'", "'Elixir.Hex.SCM'"], "packageName": "hexpm/hex", "packageURL": "pkg:github/hexpm/hex", "product": "hex", "programFiles": ["lib/hex/remote_converger.ex", "lib/hex/mix.ex", "lib/hex/scm.ex"], "programRoutines": [{"name": "'Elixir.Hex.RemoteConverger':deps/2"}, {"name": "'Elixir.Hex.RemoteConverger':converge/2"}, {"name": "'Elixir.Hex.Mix':to_lock/1"}, {"name": "'Elixir.Hex.SCM':update/1"}, {"name": "'Elixir.Hex.SCM':checkout/1"}], "repo": "https://github.com/hexpm/hex", "vendor": "hexpm", "versions": [{"changes": [{"at": "1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb", "status": "unaffected"}, {"at": "72279a8e2004b32b20d8767ff010c117193dd02c", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "380f87054e1bc08ee13d2b5311bc01f98dad2fc6", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\n\nThis issue affects hex: from 0.6.0 before 2.5.2."}], "id": "CVE-2026-96612", "lastModified": "2026-11-11T14:17:51.277", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96612", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T17:41:34.850974Z", "version": "2.0.3"}}]}, "published": "2026-10-12T16:17:07.637", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-96612.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/hexpm/hex/commit/72279a8e2004b32b20d8767ff010c117193dd02c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-96612"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "hex: hex: Arbitrary code execution via path traversal in dependency application names", "id": "2549706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549706"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.\nThis issue affects hex: from 0.6.0 before 2.5.2.", "A flaw was found in hex. This path traversal vulnerability allows a malicious package publisher to achieve arbitrary code execution and data loss. By specifying directory traversal sequences in a dependency application name, an attacker can manipulate the target directory outside the intended dependency folder. When a user or automated system fetches or updates project dependencies, hex deletes the targeted directory and extracts untrusted package contents into that location before any code is compiled."], "name": "CVE-2026-96612", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_orchestrator:2026.8", "fix_state": "Under investigation", "package_name": "ansible-automation-platform/automation-orchestrator-backend-rhel9", "product_name": "Ansible Automation Orchestrator 2026"}, {"cpe": "cpe:/a:redhat:confidential_cluster_operator:4", "fix_state": "Under investigation", "package_name": "confidential-clusters-beta/attestation-key-register-rhel9", "product_name": "Confidential Cluster Operator"}, {"cpe": "cpe:/a:redhat:confidential_cluster_operator:4", "fix_state": "Under investigation", "package_name": "confidential-clusters-beta/compute-pcrs-rhel9", "product_name": "Confidential Cluster Operator"}, {"cpe": "cpe:/a:redhat:confidential_cluster_operator:4", "fix_state": "Under investigation", "package_name": "confidential-clusters-beta/confidential-cluster-operator-bundle", "product_name": "Confidential Cluster Operator"}, {"cpe": "cpe:/a:redhat:confidential_cluster_operator:4", "fix_state": "Under investigation", "package_name": "confidential-clusters-beta/confidential-cluster-rhel9-operator", "product_name": "Confidential Cluster Operator"}, {"cpe": "cpe:/a:redhat:confidential_cluster_operator:4", "fix_state": "Under investigation", "package_name": "confidential-clusters-beta/registration-server-rhel9", "product_name": "Confidential Cluster Operator"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "agent-sandbox/agent-sandbox-router", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Under investigation", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:lightspeed_services_acm:0", "fix_state": "Under investigation", "package_name": "lightspeed-services-acm/ocp-rules-rhel9", "product_name": "Lightspeed Services for Advanced Cluster Management"}, {"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Under investigation", "package_name": "openshift-logging/vector-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:1", "fix_state": "Under investigation", "package_name": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:1", "fix_state": "Under investigation", "package_name": "openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:pdrive_lightspeed:1", "fix_state": "Under investigation", "package_name": "pen-drive/pen-drive-scanner-rhel9", "product_name": "Pen Drive Powered by Red Hat Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/de-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/ee-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/ee-supported-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-26/mcp-tools-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/ansible-builder-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/de-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/ee-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/ee-supported-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/mcp-tools-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-27/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform/automation-dashboard-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-tech-preview/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_core:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform/ee-minimal-rhel8", "product_name": "Red Hat Ansible Automation Platform Ansible Core 2"}, {"cpe": "cpe:/a:redhat:ansible_core:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform/ee-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform Ansible Core 2"}, {"cpe": "cpe:/a:redhat:ansible_core:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-tech-preview/ee-minimal-rhel8", "product_name": "Red Hat Ansible Automation Platform Ansible Core 2"}, {"cpe": "cpe:/a:redhat:ansible_core:2", "fix_state": "Under investigation", "package_name": "ansible-automation-platform-tech-preview/ee-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform Ansible Core 2"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Under investigation", "package_name": "rhdh/rhdh-must-gather-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:discovery:2::el9", "fix_state": "Under investigation", "package_name": "discovery/discovery-server-rhel9", "product_name": "Red Hat Discovery 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "bootc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "clevis-pin-trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "glycin-loaders", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "goose", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "keylime-agent-rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "loupe", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "netavark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "nmstate", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "papers", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rpm-ostree", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-afterburn", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-bootupd", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-coreos-installer", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-crypto-auditing-agent", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-crypto-auditing-log-parser", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "rust-sevctl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "stratisd", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "virt-firmware-rs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "wayland", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "container-tools:rhel8/containers-common", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "container-tools:rhel8/netavark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "rpm-ostree", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "bootc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "clevis-pin-trustee", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "fido-device-onboard", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "goose", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "keylime-agent-rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "netavark", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "nmstate", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rpm-ostree", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rust-afterburn", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rust-bootupd", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "rust-coreos-installer", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "sevctl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:rhel_cla:1", "fix_state": "Under investigation", "package_name": "rhel-cla/rhel-knowledge-bridge-rhel10", "product_name": "Red Hat Enterprise Linux command line assistant"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "chunkah", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "netavark", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:lightspeed_services_ocp:0", "fix_state": "Under investigation", "package_name": "lightspeed-services-ocp/ocp-rules-rhel9", "product_name": "Red Hat Lightspeed Services for OCP"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Under investigation", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhai/base-image-torch-2.14-cpu-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhai/base-image-torch-2.14-cuda-13.0-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-runtime-generic-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-model-registry-job-async-upload-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "conmon-rs", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "coreos-installer", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rpm-ostree", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rust-afterburn", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rust-bootupd", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rust-coreos-installer", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_update_service:5", "fix_state": "Under investigation", "package_name": "openshift-update-service/openshift-update-service-rhel8", "product_name": "Red Hat OpenShift Update Service"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Under investigation", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Under investigation", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Under investigation", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Under investigation", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "satellite/iop-advisor-backend-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "satellite/iop-advisor-engine-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "satellite/iop-vmaas-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Under investigation", "package_name": "rhtas/tuffer-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Under investigation", "package_name": "rhtas/tuftool-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Under investigation", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:3", "fix_state": "Under investigation", "package_name": "rhtpa/rhtpa-rhel10", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2026-10-12T15:39:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96612\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96612\nhttps://cna.erlef.org/cves/CVE-2026-96612.html\nhttps://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb\nhttps://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6\nhttps://github.com/hexpm/hex/commit/72279a8e2004b32b20d8767ff010c117193dd02c\nhttps://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3\nhttps://osv.dev/vulnerability/EEF-CVE-2026-96612"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.6.0,2.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hex", "source": "cna", "vendor": "hexpm"}, "product": "hex", "vendor": "hexpm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "380f87054e1bc08ee13d2b5311bc01f98dad2fc6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hex", "source": "cna", "vendor": "hexpm"}, "product": "hex", "vendor": "hexpm"}], "created": "2026-10-12T16:30:14.460473+00:00", "updated": "2026-10-12T19:00:07.120481+00:00", "vendors": ["hexpm", "hexpm$PRODUCT$hex"]}