Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97209— Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Quick assessment

Affected
elixir-lang elixir
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elixir 中的 Mix 功能存在不安全的临时文件漏洞，允许本地攻击者通过交换分区配置文件，以其他用户的身份执行代码。在分区依赖编译过程中，项目配置会通过位于共享系统临时目录下、具有固定名称的目录中的文件传递给每个分区虚拟机（VM），而分区会无条件信任其读取的内容。同一主机上的其他本地用户可在执行使用分区编译的 命令时利用此漏洞。 具体而言， 中的 函数使用 创建目录，该函数在目录已存在时不会检查其所有者。因此，若某用户率先创建了该目录，便可在 读取文件之前替换其中的配置文件。 此漏洞影响 Mix 版本：从 1.

CVSS 5.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97209

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build
Source: CVE Program / CVE List V5
Vulnerability Description
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的临时文件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-lang elixir 1.20.0-rc.4 ~ 1.20.5 cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*
elixir-lang elixir 7f3d95b60c28ae3026a5c1bf943166391245bfd1 ~ * cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-97209

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97209

请登录查看更多情报信息。

Other References for CVE-2026-97209 (6)

Same Patch Batch · elixir-lang · 2026-10-30 · 3 CVEs total

CVE-2026-115274 6.9 MEDIUM Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of ser
CVE-2026-109821 6.3 MEDIUM Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

IV. Related Vulnerabilities

Same product: elixir
Same vendor: elixir-lang
Same weakness: CWE-377