{"id":"CVE-2026-97209","title":"Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build","summary":"Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each pa…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-377"],"vendor":"elixir-lang","product":"mix","affected":["mix >= 1.20.0-rc.4 < 1.20.5","elixir-lang/elixir >= 7f3d95b60c28ae3026a5c1bf943166391245bfd1 < *"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T16:50:17.250968Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:50:46.465Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97209","references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q","label":"Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build"},{"url":"https://cna.erlef.org/cves/CVE-2026-97209.html","label":"EEF CNA record for CVE-2026-97209"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-97209","label":"OSV record EEF-CVE-2026-97209"},{"url":"https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1","label":"Introducing commit 7f3d95b in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d","label":"Fix commit 55eb912 in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777","label":"Fix commit 9adbe95 in elixir-lang/elixir"}],"tags":["cve.org","exploit-available"],"epss":0.00115,"epssPercentile":0.01557,"ingestedAt":"2026-11-05T16:24:31.094Z","slug":"CVE-2026-97209","body":"## Overview\n\nInsecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.\n\nMix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.\n\nThis issue affects mix: from 1.20.0-rc.4 before 1.20.5.\n\n## Affected\n\n- `mix >= 1.20.0-rc.4 < 1.20.5`\n- `elixir-lang/elixir >= 7f3d95b60c28ae3026a5c1bf943166391245bfd1 < *`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nOn a multi-user host, set TMPDIR to a private per-user directory with mode 0700 before running Mix, so that System.tmp_dir/0 resolves to a location other users cannot pre-create or read. Alternatively, keep partitioned compilation disabled by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or at 1, which keeps the configuration inside the parent process.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}