{"id":"CVE-2026-97209","aliases":[],"cve":{"records":[{"id":"CVE-2026-97209","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-14T21:45:01.541Z","published":"2026-10-30T08:59:17.615Z","modified":"2026-10-30T16:50:46.465Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-30T09:01:05.212Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:50:46.465Z"}],"references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-97209.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-97209","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-377","description":"CWE-377 Insecure Temporary File","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.5","versionStartIncluding":"1.20.0-rc.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:50:17.250968Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build","titleSource":"EEF","descriptionSource":"EEF","description":"Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.\n\nMix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.\n\nThis issue affects mix: from 1.20.0-rc.4 before 1.20.5.","score":5.4,"severity":"medium","published":"2026-10-30T08:59:17.615Z","modified":"2026-10-30T16:50:46.465Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"1.20.0-rc.4","status":"affected","lessThan":"1.20.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:otp/mix?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-97209"},{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"7f3d95b60c28ae3026a5c1bf943166391245bfd1","status":"affected","lessThan":"*","versionType":"git","changes":[{"at":"55eb91220a1de14dc5aa27029d1f45b0f5832b2d","status":"unaffected"},{"at":"9adbe955c8664f4be77d879dd38c003dd39fa777","status":"unaffected"}]}],"defaultStatus":"unaffected","packageURL":"pkg:github/elixir-lang/elixir","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-97209"}],"remediation":[{"text":"On a multi-user host, set TMPDIR to a private per-user directory with mode 0700 before running Mix, so that System.tmp_dir/0 resolves to a location other users cannot pre-create or read. Alternatively, keep partitioned compilation disabled by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or at 1, which keeps the configuration inside the parent process.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-97209"}],"references":["https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q","https://cna.erlef.org/cves/CVE-2026-97209.html","https://osv.dev/vulnerability/EEF-CVE-2026-97209","https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1","https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d","https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777"],"sources":[{"name":"CVE","id":"CVE-2026-97209","modified":"2026-10-30T16:50:46.465Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97209"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":5.4}],"sourceAffected":[],"observedAt":"2026-10-30T18:16:22.912Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T22:25:31.910Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T09:20:31.401Z","attemptedAt":"2026-10-30T09:20:31.401Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T09:20:32.181Z","attemptedAt":"2026-10-30T09:20:32.181Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T09:20:31.401Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T09:20:32.181Z","attemptedAt":"2026-10-30T09:20:32.181Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-97209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97209","modified":"2026-10-30T09:17:15.640","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T09:20:31.401Z"}],"aiSummary":{"text":"Elixir's mix deps.partition has an insecure temporary file vulnerability, allowing a local user to execute code as another user via a swapped partition config file, affecting versions 1.20.0-rc.4 before 1.20.5. A local user can exploit this during a mix deps.compile run. The issue is due to the creation of a directory without checking its owner.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:23:56.261Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97209"}]}}