---
id: CVE-2026-97209
title: >-
  Insecure temporary file in mix deps.partition lets a local user execute code
  in another user's dependency build
summary: >-
  Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a
  local user to execute code as another user via a swapped partition config
  file. Partitioned dependency compilation passes the project configuration to
  each pa…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-377
vendor: elixir-lang
product: mix
affected:
  - mix >= 1.20.0-rc.4 < 1.20.5
  - elixir-lang/elixir >= 7f3d95b60c28ae3026a5c1bf943166391245bfd1 < *
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T16:50:17.250968Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:50:46.465Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97209'
references:
  - url: >-
      https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q
    label: >-
      Insecure temporary file in mix deps.partition lets a local user execute
      code in another user's dependency build
  - url: 'https://cna.erlef.org/cves/CVE-2026-97209.html'
    label: EEF CNA record for CVE-2026-97209
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-97209'
    label: OSV record EEF-CVE-2026-97209
  - url: >-
      https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1
    label: Introducing commit 7f3d95b in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d
    label: Fix commit 55eb912 in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777
    label: Fix commit 9adbe95 in elixir-lang/elixir
tags:
  - cve.org
  - exploit-available
epss: 0.00115
epssPercentile: 0.01557
ingestedAt: '2026-11-05T16:24:31.094Z'
---

## Overview

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.

Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.

This issue affects mix: from 1.20.0-rc.4 before 1.20.5.

## Affected

- `mix >= 1.20.0-rc.4 < 1.20.5`
- `elixir-lang/elixir >= 7f3d95b60c28ae3026a5c1bf943166391245bfd1 < *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

On a multi-user host, set TMPDIR to a private per-user directory with mode 0700 before running Mix, so that System.tmp_dir/0 resolves to a location other users cannot pre-create or read. Alternatively, keep partitioned compilation disabled by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or at 1, which keeps the configuration inside the parent process.