Insecure Temporary File Vulnerability in Mix by Elixir

CVE-2026-97209

What is CVE-2026-97209?

An insecure temporary file vulnerability in the Mix dependency management tool in Elixir allows local users to execute arbitrary code as another user during partitioned compilation processes. The vulnerability arises because Mix does not verify the ownership of the temporary directory it creates, enabling an attacker to replace project configuration files with malicious ones. This situation can be exploited in shared system environments and particularly impacts versions from 1.20.0-rc.4 to before 1.20.5. Users should ensure they update to the latest version to mitigate this risk.

References