CVE-2026-105280

The hexpm hex package (versions 0.20.2 before 2.5.2 ) is vulnerable to an Improper Validation of Integrity Check Value (CWE-354). When using mix hex.package fetch PACKAGE VERSION --output -, the tool writes bytes from Hex.SCM.fetch/3 directly to standard output without performing the required che...