Read the docs
TI-2026-82970 Aliases CVE-2026-97209

Insecure temporary file in Mix deps.partition enables code execution

Priority MEDIUM 60CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Mix in Elixir from 1.20.0-rc.4 before 1.20.5 has an insecure temporary file weakness (CWE-377). Partitioned dependency compilation stores the project configuration in a fixed-name directory under the shared system temporary directory, and the partition trusts the file it reads back. A local user with low privileges who creates that directory first can replace the file during a mix deps.compile run and execute code as another user on the same host.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix Fixed elixir (elixir-lang): 1.20.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-langelixir1.20.0-rc.4 to before 1.20.51.20.5Patch availableCNA
  • elixir Vendorelixir-lang Affected 1.20.0-rc.4 to before 1.20.5 Fixed in 1.20.5 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade Elixir to 1.20.5 or later. The sources list no fixed version for elixir.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA elixir (elixir-lang) Fixed in 1.20.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-97209
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Patch 2

Advisory 1

Other 3

  • TI-2026-82969 Elixir JSON.decode lets huge integers exhaust CPU and memory CVSS 4.0MEDIUM 6.9
  • TI-2026-82968 Unbounded port parsing in Elixir URI.parse/1 enables CPU exhaustion CVSS 4.0MEDIUM 6.3
  • TI-2026-53033 Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir CVSS 4.0MEDIUM 5.9
  • TI-2026-36671 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences