Path traversal in Hex via unvalidated dependency app names

Unsafe Deserialization of Erlang Terms in hex_core

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch

erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

Hex trusts its bundled CA certificates when cacerts_path is set

Lockfile checksums not verified in Hex allows dependency integrity bypass

Terminal escape sequence injection in Hex via unneutralized server-supplied output

hex_core decompresses registry and Erlang term API responses without size limits

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror