Elixir Mix CVE-2026-97209

Exploitation requires ALL of the following, none of which is default: (1) partitioned dependency compilation explicitly enabled via the MIX_OS_DEPS_COMPILE_PARTITION_COUNT environment variable set greater than 1 (off by default); (2) a mix deps.compile run - directly or via mix compile/mix test - that compiles at least two non-local dependencies; (3) a system temporary directory shared with other local users, which is the Linux default when TMPDIR is unset so System.tmp_dir() resolves to /tmp; and (4) a local, unprivileged attacker account on the same host who creates and owns /tmp/mix_deps_partition before the victim's build, then wins the race to rewrite the config file between the parent's File.write and the partition client's File.read!. Limiting factors: the attacker needs local access and must win a timing race (AT:P), the victim must actually launch a partitioned build (UI:P), and hosts with per-user temporary directories - macOS and Windows by default - are not affected unless TMPDIR points at a shared location. Even without pre-creating the directory, the world-readable partition file discloses project configuration (including Mix.install compile-time config) to other local users while the build runs.

This is a genuine but conditional local privilege-escalation / cross-user code-execution flaw (CWE-377, insecure temporary file) rather than a high-urgency remotely exploitable issue. The only severity signal in the input, a CVSS 4.0 base vector scoring 5.4 (medium), is internally consistent with the mechanism: AV:L (local attacker on the same host), AT:P (an attack requirement - the attacker must win the race between the parent's write and the partition client's read, and must pre-create the shared directory), PR:L (attacker needs their own unprivileged local account), UI:P (the victim must passively run a partitioned build), and VC:H/VI:H/VA:H (arbitrary shell commands run as the victim user). No EPSS score was provided, so exploitation-probability cannot be quantified. KEV status is not listed, so there is no indication of active exploitation - do not treat this as exploited in the wild. The GHSA advisory includes a step-by-step proof-of-concept methodology, so a public PoC reference exists, but it is not verified as working, drop-in exploit code. The vuln.today priority is 'this_month' (not act_now/emergency), which aligns with the medium CVSS and local/conditional nature: this is a real priority to patch on a normal cadence, especially for shared CI runners and multi-user developer hosts, but it is not a drop-everything remote RCE. The practical risk is tightly bounded by non-default configuration (partitioned compilation must be explicitly enabled) and by requiring a shared, attacker-accessible temp directory.

On a shared multi-user Linux host (or shared CI runner) where TMPDIR is unset so System.tmp_dir() resolves to /tmp, a low-privileged local attacker pre-creates and owns /tmp/mix_deps_partition and watches it. When a victim developer or CI user runs mix deps.compile with MIX_OS_DEPS_COMPILE_PARTITION_COUNT>1 on a project with at least two non-local dependencies, Mix writes the Base64/term-encoded project config into that attacker-owned directory; before the partition VM reads it back, the attacker rewrites the serialized term to add a 'compile:' shell command to each dependency, and that command executes as the victim user. A detailed proof-of-concept exists in the GHSA advisory, but it is not verified as working exploit code.