The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a     malicious package publisher or a hostile repository server to inject terminal control sequences into the     output of Mix tasks. Hex prints strings supplied by the package repository and the documentation search     service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control     characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search     results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor     URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error     bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences     (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional     overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs,     package descriptions and suggested commands, concealing real output, or writing to the clipboard. No     authentication or privileged position is required; only publishing a package. This issue affects hex: from     0.0.1 before 2.5.2. (CVE-2026-81856)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-81856

low Nessus Plugin ID 369190

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Nov 6, 2026, 2:22 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611061422
Version 1.3 Oct 29, 2026, 7:21 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610290721
Version 1.2 Oct 23, 2026, 5:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610231756
Version 1.1 Oct 22, 2026, 12:02 AM New Plugin Feed: 202610220002