What is CVE-2026-21618?

CVE-2026-21618 is a medium-severity vulnerability in Hex Hexpm, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-01-19.

How severe is CVE-2026-21618?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Hex Hexpm

CVE-2026-21618

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (12.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Hex Hexpm
Hexpm Hex.pm — versions 2025-10-01
Hexpm — versions 617e44c71f1dd9043870205f371d375c5c4d886d

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, vendor-advisory, Mitigation, Vendor Advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (Patch, patch)

Frequently asked questions

What is CVE-2026-21618?: CVE-2026-21618 is a medium-severity vulnerability in Hex Hexpm, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-01-19.
How severe is CVE-2026-21618?: Medium severity. CVSS v3 base score is 6.1 out of 10.