CVE-2026-97209Medium· 5.4▾ TwilightPoC availableInsecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each pa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.
Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.
This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
mix >= 1.20.0-rc.4 < 1.20.5elixir-lang/elixir >= 7f3d95b60c28ae3026a5c1bf943166391245bfd1 < *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
On a multi-user host, set TMPDIR to a private per-user directory with mode 0700 before running Mix, so that System.tmp_dir/0 resolves to a location other users cannot pre-create or read. Alternatively, keep partitioned compilation disabled by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or at 1, which keeps the configuration inside the parent process.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109821Medium· 6.3Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
CVE-2026-115274Medium· 6.9Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
CVE-2026-121549Medium· 4.4nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
CVE-2024-7358High· 7.8Point B Ltd Getscreen Agent MSI Installer getscreen.msi temp file
CVE-2026-113713Medium· 4.4virtualenv: Temporary app-data can leave dangling seed package links
CVE-2026-55480Medium· 5.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems