CVE-2026-97209

The record

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.

Affected packages

Related vulnerabilities

• CVE-2026-62847 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. CWE-377
• CVE-2026-93864 A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local… CWE-377
• CVE-2026-113713 virtualenv is a tool for creating isolated virtual python environments. CWE-377
• CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-377
• CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. CWE-377
• CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and… CWE-377
• CVE-2026-63404 Faktory is a language-agnostic background job server. CWE-377
• CVE-2026-55086 Etherpad is a real-time collaborative editor. CWE-377