CVE-2026-97209 | BDVDB-2026-398148 Detail
elixir-langelixir
Description#
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Impact#
A local user on a shared host who creates the partition directory before the victim's build replaces the serialized configuration and runs arbitrary shell commands as the developer or CI user whose mix deps.compile uses partitioned compilation.
Weaknesses#
- CWE-377 Insecure Temporary File
References#
- https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q
- https://cna.erlef.org/cves/CVE-2026-97209.html
- https://osv.dev/vulnerability/EEF-CVE-2026-97209
- https://github.com/elixir-lang/elixir/commit/7f3d95b60c28ae3026a5c1bf943166391245bfd1
- https://github.com/elixir-lang/elixir/commit/55eb91220a1de14dc5aa27029d1f45b0f5832b2d
- https://github.com/elixir-lang/elixir/commit/9adbe955c8664f4be77d879dd38c003dd39fa777
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.