Is CVE-2026-97209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97209 being exploited in the wild.

How severe is CVE-2026-97209?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Elixir-lang Elixir 1.20.0-rc.4 to 1.20.4.

How is CVE-2026-97209 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-97209?

Check whether you run Elixir-lang Elixir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97209: Elixir Mix insecure temporary file in deps.partition

CVE-2026-97209 · Severity: info · Published 2026-10-30

Elixir's Mix build tool uses a shared temporary directory when compiling dependencies in parallel. A local attacker on a multi-user system can create that directory first and swap out the build configuration file before it is read, allowing arbitrary code execution as the developer or CI user running the build. This affects development and CI pipelines on shared Linux systems where partitioned compilation is explicitly enabled.

Technologies: Elixir-lang Elixir. Vendors: Elixir-lang.

Quick answers

Is CVE-2026-97209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97209 being exploited in the wild.
How severe is CVE-2026-97209?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Elixir-lang Elixir 1.20.0-rc.4 to 1.20.4.
Is there a fix for CVE-2026-97209?: Yes: fixed in Elixir 1.20.5. Until then: On multi-user systems, set TMPDIR to a private per-user directory with mode 0700 before running Mix. Alternatively, disable partitioned compilation by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or set to 1. Linux systems are affected by default; macOS and Windows are unaffected unless TMPDIR is explicitly configured to a shared location. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97209 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-97209?: Check whether you run Elixir-lang Elixir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elixir 1.20.5

On multi-user systems, set TMPDIR to a private per-user directory with mode 0700 before running Mix. Alternatively, disable partitioned compilation by leaving MIX_OS_DEPS_COMPILE_PARTITION_COUNT unset or set to 1. Linux systems are affected by default; macOS and Windows are unaffected unless TMPDIR is explicitly configured to a shared location.

Technical details

The Mix.Tasks.Deps.Partition module writes serialized project configuration to a fixed-name, world-readable file in the shared system temp directory (/tmp/mix_deps_partition) and relies on partitioned VMs to read it back without validation. An attacker can pre-create the directory with their own permissions, then perform a time-of-check-time-of-use (TOCTOU) race to swap the config file before partition VMs deserialize it. The attacker controls the dependency compile commands, which execute as shell commands in the victim's build context. Affects Elixir/mix 1.20.0-rc.4 through 1.20.4; fixed in 1.20.5.

Affected products

Elixir-lang Elixir 1.20.0-rc.4 to 1.20.4

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.