CVE-2026-97209

Name of the Vulnerable Software and Affected Versions Elixir versions 1.20.0-rc.4 through 1.20.4

Description An insecure temporary file issue in Mix deps.partition allows a local user to execute arbitrary code as another user. During partitioned dependency compilation, the project configuration is passed to partition VMs via a file in a fixed-name directory within the shared system temporary directory. The function Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex uses File.mkdir p/1 to create this directory, which does not verify the directory owner if it already exists. A local attacker can pre-create the directory and replace the configuration file before the client/0 function reads it. The client then decodes the malicious file using :erlang.binary to term/1 and executes injected shell commands via the compile: option of dependencies. Additionally, the world-readable nature of the partition file may disclose project configurations to other local users. This issue requires partitioned compilation to be enabled via the MIX OS DEPS COMPILE PARTITION COUNT variable and a shared system temporary directory.

Recommendations Update Elixir to version 1.20.5. As a temporary workaround, set TMPDIR to a private per-user directory with mode 0700 before running Mix. Alternatively, disable partitioned compilation by leaving MIX OS DEPS COMPILE PARTITION COUNT unset or setting it to 1.