Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected. An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering. This issue affects hex: from 0.16.0 before 2.4.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32148 Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile chec… https://www.cve.org/CVERecord?id=CVE-2026-32148
Post summary
The text announces CVE‑2026‑32148 as an insufficient verification vulnerability that allows a dependency integrity bypass, but provides no PoC, exploit, active exploitation, or remediation details.
CVE-2026-32148 Dependency Integrity Bypass in Hex Package Manager via Unverified... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32148 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE‑2026‑32148 as a dependency integrity bypass in the Hex Package Manager, without mentioning any exploit, patch, or active exploitation.
🚨*CVE* CVE-2026-32148 Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile chec… https://www.cve.org/CVERecord?id=CVE-2026-32148 ----- Traducción: CVE-2026-32148 Ins… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑32148, describing a dependency integrity bypass in hexpm hex’s Hex.RemoteConverger module, but provides no PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hex | hex | - | - | - |