Am I affected?
This record states its affected versions in a form that can't be compared automatically.
≥
617e44c
<
c692438
affected
every other version:
unaffected
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS).
This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3.
This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.
Weaknesses & attack patterns
Weakness
CWE-79
·
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
in catalog →
MITRE ↗
Attack patterns
CAPEC-63
·
Cross-Site Scripting (XSS)
MITRE ↗
Affected — GitHub / hexpm/hexpm Repository ↗
≥
617e44c
<
c692438
affected
every other version:
unaffected
default status
unaffected
cpe
cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
modules · source files · routines
modules
'Elixir.HexpmWeb.SharedAuthorizationView'
source files
lib/hexpm_web/views/shared_authorization_view.ex
routines
'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3
Affected — hexpm / hex.pm
≥
2025-10-01
<
2026-01-19
affected
every other version:
unaffected
default status
unaffected
References
github.com/hexpm/hexpm ·
GHSA-6cw9-5gg4-rhpj ↗
vendor-advisory
osv.dev ·
EEF-CVE-2026-21618 ↗
related
Credits
Joud Zakharia / zentrust partners GmbH
Finder
Jonatan Männchen / EEF
Remediation developer
Eric Meadows-Jönsson / Hex.pm
Remediation reviewer
CVSS breakdown
HIGH 8.5
open in calculator →
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N