Hi,

The following vulnerability was published for elixir-lang.

CVE-2026-97209[0]:
| Insecure Temporary File vulnerability in Mix deps.partition in
| Elixir allows a local user to execute code as another user via a
| swapped partition config file. Partitioned dependency compilation
| passes the project configuration to each partition VM through a file
| in a fixed-name directory under the shared system temporary
| directory, and the partition trusts what it reads back. Another
| local user on the same host can exploit this during a mix
| deps.compile run that uses partitioned compilation.
| Mix.Tasks.Deps.Partition.server/4 in
| lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with
| File.mkdir_p/1, which accepts an existing directory without checking
| its owner, so a user who created it first can replace the file
| before client/0 reads it.  This issue affects mix: from 1.20.0-rc.4
| before 1.20.5.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-97209
https://www.cve.org/CVERecord?id=CVE-2026-97209
[1] https://github.com/elixir-lang/elixir/security/advisories/GHSA-96q6-xhwp-fc8q
[2] https://cna.erlef.org/cves/CVE-2026-97209.html
[3] https://osv.dev/vulnerability/EEF-CVE-2026-97209

Regards,
Salvatore