Answer in brief
CVE-2026-97209 records a Medium severity (CVSS 5.4) vulnerability in Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build. The current sources do not mark it as known exploited. The current feed maps elixir-lang/elixir (generic), elixir-lang/elixir-lang/elixir (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-lang/elixir (generic), elixir-lang/elixir-lang/elixir (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-lang/elixirgeneric | >=1.20.0-rc.4 <1.20.5 | 1.20.5 |
| elixir-lang/elixir-lang/elixirgeneric | >=7f3d95b60c28ae3026a5c1bf943166391245bfd1 <* | * |
Published upstream
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Quoted source text, attributed separately from HOL analysis.