Medium 5.4Published Oct 30, 2026

CVE-2026-97209Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Updated under an hour ago (Oct 30, 2026, 6:23 AM ET)

Does this affect you?

It affects elixir-lang elixir. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for elixir-lang elixir Exploited in the last 30 days

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.

CVSS: 5.4 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-377
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Received
Record last updated: Oct 30, 2026
First seen by InfoSec Signals: Oct 30, 2026

Affected products

Affected products

elixir-lang elixir elixir-lang:elixir	from 1.20.0-rc.4 before 1.20.5	CNA record

References

References

https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-97209.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-97209	related
https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1	related
https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d	patch
https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.