Source: elixir-lang Version: 1.20.4+dfsg-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for elixir-lang. CVE-2026-97209[0]: | Insecure Temporary File vulnerability in Mix deps.partition in | Elixir allows a local user to execute code as another user via a | swapped partition config file. Partitioned dependency compilation | passes the project configuration to each partition VM through a file | in a fixed-name directory under the shared system temporary | directory, and the partition trusts what it reads back. Another | local user on the same host can exploit this during a mix | deps.compile run that uses partitioned compilation. | Mix.Tasks.Deps.Partition.server/4 in | lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with | File.mkdir_p/1, which accepts an existing directory without checking | its owner, so a user who created it first can replace the file | before client/0 reads it. This issue affects mix: from 1.20.0-rc.4 | before 1.20.5. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-97209 https://www.cve.org/CVERecord?id=CVE-2026-97209 [1] https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q [2] https://cna.erlef.org/cves/CVE-2026-97209.html [3] https://osv.dev/vulnerability/EEF-CVE-2026-97209 Regards, Salvatore
