High severity8.8OSV Advisory· Published Feb 4, 2019· Updated Jun 17, 2026
CVE-2019-1000013
CVE-2019-1000013
Description
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
hex_coreHex | < 0.4.0 | 0.4.0 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/hexpm/hex_core/pull/48nvdPatchThird Party AdvisoryWEB
- github.com/hexpm/hex_core/pull/51nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-q3cc-rr2c-87r6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-1000013ghsaADVISORY
News mentions
0No linked articles in our index yet.