{"id":"CVE-2026-97209","kind":"vulnerability","aliases":["CVE-2026-97209"],"related":[],"title":"Elixir Mix: shared temp directory lets local user run code as others","description":"Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.\n\nMix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.\n\nThis issue affects mix: from 1.20.0-rc.4 before 1.20.5.","summary":"Elixir's Mix build tool creates a predictable directory in the shared system temp folder during partitioned dependency compilation without checking who owns it. A local user on the same machine can swap in a config file so that the build runs their code as the user running mix deps.compile.","severity":"medium","cvss":5.4,"epss":0.00115,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-runners","elixir","mix","runtime","shared-hosts"],"not_affected_if":["mix-below-1.20.0-rc.4","non-partitioned-compile","single-user-machine"],"how_to_check":"- Run `mix --version` and confirm the Elixir version shown is in the affected range.\n- Check whether builds use partitioned compilation (`mix deps.compile` with partitioning enabled); unknown if the sources give the exact flag.\n- Look for a shared multi-user host or CI runner where other local users have access.","fix":"- `mix` from `1.20.5` onward (affected: `1.20.0-rc.4` before `1.20.5`).","status":"open","published_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:40+00:00","updated_at":"2026-10-30T18:23:37+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T09:30:40Z","model":"claude-haiku-5-5","output":{"fix":"- `mix` from `1.20.5` onward (affected: `1.20.0-rc.4` before `1.20.5`).","reach":"local","title":"Elixir Mix: shared temp directory lets local user run code as others","impact":"high","summary":"Elixir's Mix build tool creates a predictable directory in the shared system temp folder during partitioned dependency compilation without checking who owns it. A local user on the same machine can swap in a config file so that the build runs their code as the user running mix deps.compile.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["elixir","mix","shared-hosts","ci-runners"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"local user runs code as another user on the host","analyst_note":"","how_to_check":"- Run `mix --version` and confirm the Elixir version shown is in the affected range.\n- Check whether builds use partitioned compilation (`mix deps.compile` with partitioning enabled); unknown if the sources give the exact flag.\n- Look for a shared multi-user host or CI runner where other local users have access.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-machine","non-partitioned-compile","mix-below-1.20.0-rc.4"],"who_is_affected":"Only machines where Mix runs partitioned dependency compilation and where another local user can log in or run code. The risk is local privilege escalation, not remote access. Single-user developer machines and CI runners that run one job at a time are much less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4303,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97209':15A,18A '/4':158C '1.20.0':196C '1.20.5':199C 'accept':168C 'affect':193C 'allow':87C 'anoth':95C,137C 'back':136C 'build':31B,68B 'check':48B,173C 'ci':20B 'ci-runn':19B 'client/0':188C 'code':10A,71B,93C 'compil':46B,105C,155C 'config':63B,101C 'configur':109C 'creat':33B,161C,180C 'cve':13A,16A 'depend':45B,104C 'deps.compile':77B,150C 'deps.partition':84C 'directori':5A,36B,122C,128C,163C,171C 'elixir':1A,22B,28B,86C 'execut':92C 'exist':170C 'exploit':145C 'file':64B,80C,102C,116C,186C 'file.mkdir':165C 'first':182C 'fix':120C 'fixed-nam':119C 'folder':42B 'host':27B,143C 'insecur':78C 'issu':192C 'let':6A 'lib/mix/lib/mix/tasks/deps.partition.ex':160C 'local':7A,53B,89C,138C 'machin':58B 'mix':2A,23B,30B,76B,83C,149C,194C 'mix.tasks.deps.partition.server':157C 'mix.tasks.deps.partition.server/4':156C 'name':121C 'other':12A 'own':50B 'owner':175C 'p/1':166C 'partit':44B,100C,103C,112C,131C,154C 'pass':106C 'predict':35B 'project':108C 'rc.4':197C 'read':135C,189C 'replac':184C 'run':9A,69B,75B,151C 'runner':21B 'runtim':24B 'share':3A,26B,39B,125C 'shared-host':25B 'swap':60B,99C 'system':40B,126C 'temp':4A,41B 'temporari':79C,127C 'tool':32B 'trust':132C 'use':153C 'user':8A,54B,74B,90C,96C,139C,178C 'via':97C 'vm':113C 'vulner':81C 'without':47B,172C","nicknames":[],"mitigations":[],"who_affected":"Only machines where Mix runs partitioned dependency compilation and where another local user can log in or run code. The risk is local privilege escalation, not remote access. Single-user developer machines and CI runners that run one job at a time are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97209","severity":null,"published_at":"2026-10-30T09:17:15+00:00","modified_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97209","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97209","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:37+00:00","fetched_at":"2026-10-30T18:23:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}