CVE-2026-97209
Received Received - Intake

Insecure Temporary File Handling in Elixir Mix deps.partition

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: EEF

Description
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-97209
EUVD
EUVD-2026-113759

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
elixir-lang elixir 1.20.0-rc.4
elixir-lang elixir 7f3d95b60c28ae3026a5c1bf943166391245bfd1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-97209 is an insecure temporary file vulnerability in Elixir's Mix tool affecting versions 1.20.0-rc.4 to 1.20.4. It occurs in the mix deps.partition feature where a local attacker can exploit a shared temporary directory to replace a configuration file before it is read by partition VMs. This allows injection of malicious shell commands into dependency compilation, executing arbitrary code with the victim's privileges.

Detection Guidance

Check if partitioned compilation is enabled by running: echo $MIX_OS_DEPS_COMPILE_PARTITION_COUNT. If set to a value greater than 1, the system is potentially vulnerable. Inspect the temporary directory for unexpected files named mix_deps_partition or similar.

Impact Analysis

This vulnerability allows a local attacker to execute arbitrary code as another user during dependency compilation. If you use Elixir versions 1.20.0-rc.4 to 1.20.4 with partitioned compilation enabled, an attacker on the same system could modify build files to run malicious commands under your user account. This could lead to data theft, system compromise, or further lateral movement in shared environments.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. If exploited, it may result in unauthorized access to personal or health data, triggering compliance violations. Organizations must ensure Elixir is updated to version 1.20.5 or later to mitigate this risk and maintain regulatory compliance.

Mitigation Strategies

Set TMPDIR to a private directory before running Mix: export TMPDIR=/path/to/private/tmp. Alternatively, disable partitioned compilation by unsetting MIX_OS_DEPS_COMPILE_PARTITION_COUNT or setting it to 1. Upgrade Elixir to version 1.20.5 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart