CVE-2026-97209 Details
Description
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
A vulnerability in the Elixir Mix tool's partitioned dependency compilation feature allows local users to execute arbitrary code as another user. This is achieved by swapping a partition configuration file with one that contains malicious payloads. The vulnerability exists in Elixir versions 1.20.0-rc.4 prior to 1.20.5.
Users can update to Elixir version 1.20.5 or set the TMPDIR environment variable to a private directory before running Mix. Alternatively, keep partitioned compilation disabled by setting MIX_OS_DEPS_COMPILE_PARTITION_COUNT to 1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-97209.html | EEF | AdvisoryBundleRemedy |
| https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d | EEF | Source CodeVendor |
| https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1 | EEF | Source CodeVendor |
| https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777 | EEF | Source CodeVendor |
| https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q | EEF | AdvisoryBundleRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-97209 | EEF | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-377 | Insecure Temporary File | EEF |
Affected Products
| Product | Versions |
|---|---|
| Elixir | >= 1.20.0-rc.4, < 1.20.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | EEF |