CVE-2026-82584: Igniter XSS Vulnerability

CVE-2026-82584 Overview

CVE-2026-82584 is an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability [CWE-150] in the ash-project/igniter Elixir library. The mix igniter.install task prints a confirmation panel that lists a package's hex metadata as an anti-typosquatting safeguard. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields to the terminal with only newlines stripped. A malicious package publisher can embed ANSI terminal escape sequences in metadata fields to overwrite the panel and forge trusted author names and download counts. The issue affects igniter from version 0.8.1 before 0.8.4.

Critical Impact
A malicious or typosquatted hex package can forge the mix igniter.install confirmation prompt, deceiving developers into approving a malicious dependency.

Affected Products

ash-project/igniter version 0.8.1
ash-project/igniter versions after 0.8.1 and before 0.8.4
Elixir projects that consume mix igniter.install for hex dependency installation

Discovery Timeline

2026-09-07 - CVE-2026-82584 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82584

Vulnerability Analysis

The mix igniter.install command displays a confirmation panel before adding a hex package as a dependency. The panel lists metadata pulled from hex.pm, including the package description, author usernames, publisher usernames, version, release date, and download counts. This panel functions as a human-in-the-loop safeguard against typosquatting.

The function format_hex_confirmation_from_popup_fields/1 in Igniter.Project.Deps interpolated these fields directly into a heredoc string written to standard output. Only newline characters were stripped from the input. Because most terminals interpret ANSI escape sequences (such as cursor movement, line erase, and carriage returns), a publisher who controls a field like meta.description can inject sequences that redraw the panel after the metadata is rendered. The overwritten output can substitute trusted author names, inflate download counters, and hide the actual publisher identity.

Root Cause

The vulnerability stems from writing untrusted, publisher-controlled strings to a terminal without stripping C0/C1 control characters. Newline removal alone does not neutralize escape sequences beginning with the ESC (\\x1b) byte or carriage returns used for line overwrite. This is a classic Output Encoding failure classified under [CWE-150] (Improper Neutralization of Escape, Meta, or Control Sequences).

Attack Vector

An attacker publishes a hex package whose name resembles a legitimate dependency. The package's meta.description, owner usernames, requirement names, or version string contain ANSI escape sequences. When a developer runs mix igniter.install <typosquat_name>, the confirmation panel renders and is then rewritten by the embedded sequences to display attacker-controlled trust signals. The developer approves the install based on the forged panel and the malicious dependency is added to the project.

elixir

# Source: https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816
# Patch in lib/igniter/project/deps.ex

  defp format_hex_confirmation_from_popup_fields(fields) when is_map(fields) do
+    # Every value is publisher-controlled hex metadata printed to the terminal;
+    # strip control characters so it cannot rewrite the confirmation panel.
+    f = Map.new(fields, fn {k, v} -> {k, hex_popup_terminal_safe(v)} end)
+
    """
-    You are installing the package "#{fields.package}":
+    You are installing the package "#{f.package}":

-    Description:       #{fields.description}
-    Current version:   #{fields.version} (released #{fields.release_date})
-    hex.pm authors:    #{fields.hex_authors}
-    hex.pm publishers: #{fields.hex_publishers}
-    Dependencies:      #{fields.deps_list}
-    Downloads:         #{fields.downloads_this_version} (this version), #{fields.downloads_last_seven_days} (last 7 days), #{fields.downloads_all_time} (all time)
+    Description:       #{f.description}
+    Current version:   #{f.version} (released #{f.release_date})
+    hex.pm authors:    #{f.hex_authors}
+    hex.pm publishers: #{f.hex_publishers}
+    Dependencies:      #{f.deps_list}
+    Downloads:         #{f.downloads_this_version} (this version), #{f.downloads_last_seven_days} (last 7 days), #{f.downloads_all_time} (all time)
    """
  end

+  defp hex_popup_terminal_safe(str) when is_binary(str),
+    do: String.replace(str, ~r/\p{Cc}/u, "")

Source: GitHub Commit d492b1aa. The patch introduces hex_popup_terminal_safe/1, which removes all Unicode control characters (\p{Cc}) from every publisher-controlled field before interpolation.

Detection Methods for CVE-2026-82584

Indicators of Compromise

Presence of igniter versions 0.8.1 through 0.8.3 in a project's mix.lock or mix.exs.
Newly added hex dependencies whose metadata on hex.pm contains ESC (\\x1b), carriage return (\r), or other C0/C1 control bytes.
Recent mix igniter.install invocations that added dependencies with unusually short publisher histories.

Detection Strategies

Scan repository history and CI logs for mix igniter.install commands invoked against vulnerable igniter versions.
Query hex.pm package metadata for control characters in description, owners, and requirements fields as a supply-chain hygiene check.
Review dependency change commits for packages introduced by igniter that lack established maintainer reputation.

Monitoring Recommendations

Monitor developer workstations and CI runners for outbound network activity following mix deps.get on recently added hex packages.
Track additions to mix.exs and mix.lock in pull requests, and require reviewer verification of package authorship independent of the terminal panel.
Log terminal output from CI pipelines and inspect for embedded ANSI escape sequences in dependency installation steps.

How to Mitigate CVE-2026-82584

Immediate Actions Required

Upgrade igniter to version 0.8.4 or later across all developer workstations and CI systems.
Audit dependencies added via mix igniter.install while running versions 0.8.1 through 0.8.3, and verify each package's authorship and publisher directly on hex.pm.
Remove or replace any hex dependency whose provenance cannot be independently confirmed outside of the igniter confirmation panel.

Patch Information

The fix is committed in ash-project/igniter at commit d492b1aa and released in version 0.8.4. Additional details are available in the GitHub Security Advisory GHSA-cj7w-j579-gc42, the CNA CVE-2026-82584 Record, and the OSV Vulnerability EEF-CVE-2026-82584 entry.

Workarounds

Verify hex package authorship and download counts directly on hex.pm before approving any mix igniter.install prompt when running a vulnerable version.
Add dependencies manually to mix.exs and run mix deps.get instead of relying on the igniter.install confirmation panel until the upgrade is applied.
Pipe mix igniter.install output through a filter that strips ANSI escape sequences, for example sed $'s/\\x1b\\[[0-9;]*[a-zA-Z]//g', to prevent panel overwrite.

bash

# Upgrade igniter to a patched version in mix.exs
# {:igniter, "~> 0.8.4", only: [:dev]}

mix deps.update igniter
mix deps.get
mix deps | grep igniter