CVE-2026-97209mediumCWE-377

CVE-2026-97209: falha de média gravidade em elixir-lang elixir

Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Publicada em

Seguir esta CVE+ Monitorar elixir+ Monitorar elixir-lang

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.1%
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation. Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
elixir-lang · elixir
CVEs relacionadas — elixir-lang elixir

No mesmo produto, das mais perigosas para as menos.

CVE-2026-115274MEDIUMUnbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in ElixirEPSS 0.5%CVE-2026-109821MEDIUMUnbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in ElixirEPSS 0.5%CVE-2026-75758MEDIUMUnbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in ElixirEPSS 0.2%CVE-2026-49762MEDIUMUnbounded integer parsing in the Version module enables CPU and memory exhaustion denial of serviceEPSS 0.2%