Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build
Impact
Elixir's mix deps.partition has an insecure temporary file vulnerability, allowing a local user to execute code as another user via a swapped partition config file, affecting versions 1.20.0-rc.4 before 1.20.5. A local user can exploit this during a mix deps.compile run. The issue is due to the creation of a directory without checking its owner.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
On a multi-user host, set TMPDIR to a private per-user directory with mode 0700 before running Mix, so that System.tmp_dir/0 resolves to a location other users cannot pre-create or read. Alternatively, keep partitioned compilation disabled by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or at 1, which keeps the configuration inside the parent process.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
elixir-lang · EEF
elixir
1 range
elixir-lang · EEF
elixir
Package identity
pkg:otp/mix?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.20.0-rc.4 → before 1.20.5
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*elixir-lang · EEF
elixir
1 range
elixir-lang · EEF
elixir
Package identity
pkg:github/elixir-lang/elixirIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7f3d95b60c28ae3026a5c1bf943166391245bfd1 → before *
git versions
From 55eb91220a1de14dc5aa27029d1f45b0f5832b2d: unaffected
From 9adbe955c8664f4be77d879dd38c003dd39fa777: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*Original source description
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.
Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.
This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-97209View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.20.0-rc.4
Before: 1.20.5
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.5",
"versionStartIncluding": "1.20.0-rc.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-97209
Observed 2026-10-30T18:16:22.912Z · upstream updated 2026-10-30T16:50:46.465Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T16:50:17.250968Z", "decisions": [ { "name": "Exploitation", "value": "poc" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.