CVE-2026-21618

Medium

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.

SeverityMedium

CVSS6.1

Exploit probability—

ProductHexpm

PublishedJan 19, 2026

First seenJan 19, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

hex hexpm2026-01-19 or later

Patches

github.com/hexpm/hexpm/commit/c692438684ead90c3bcbfb9ccf4e63c768c668a8

Vendor advisories

github.com/hexpm/hexpm/security/advisories/GHSA-6cw9-5gg4-rhpj

Affected products

Product	Affected versions	Fixed in
hex hexpm	2025-10-01 ≤ v < 2026-01-19	2026-01-19

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.