Live › vulnerability › CVE-2026-97209
Elixir's Mix build tool creates a predictable directory in the shared system temp folder during partitioned dependency compilation without checking who owns it. A local user on the same machine can swap in a config file so that the build runs their code as the user running mix deps.compile.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Only machines where Mix runs partitioned dependency compilation and where another local user can log in or run code. The risk is local privilege escalation, not remote access. Single-user developer machines and CI runners that run one job at a time are much less exposed.
No product ranges from the sources yet.
mix --version and confirm the Elixir version shown is in the affected range.mix deps.compile with partitioning enabled); unknown if the sources give the exact flag.mix from 1.20.5 onward (affected: 1.20.0-rc.4 before ).1.20.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.
Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.
This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-97209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.