CVE-2020-13802

CVE-2020-13802 affects Rebar3 versions 3.0.0-beta.3 to 3.13.2, exposing OS command injection via a URL parameter in dependency specifications. The vulnerability is described across multiple sources (NVD, Gentoo GLSA, Mageia, Nessus, OpenVAS, Exploit-DB) with CVSS v3.1 base score 9.8 (CRITICAL). E...

CVE-2019-1000014

Erlang/OTP Rebar3 versions 3.7.0–3.7.5 contain a Signing oracle vulnerability in Package registry verification that can allow code execution when victims fetch packages from a malicious/compromised mirror; fixed in 3.8.0.

CVE-2026-21619

CVE-2026-21619 affects Hex ecosystem: hex_core (src/hex_api.erl), hex (src/mix_hex_api.erl), and rebar3 (apps/rebar/src/vendored/r3_hex_api.erl). The issue is an Uncontrolled Resource Consumption and Deserialization of Untrusted Data that allows Object Injection and excessive allocation via hex_c...