SZB-1650dab70c
Elixir Mix deps.partition flaw allows local code execution, EUVD reports
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Elixir
- Product
- Elixir (Mix deps.partition)
- First seen
Summary
The EU Vulnerability Database lists EUVD-2026-113759, an insecure temporary file issue in Elixir's Mix deps.partition with a CVSS score of 5.4. The listing says a local user can execute code as another user by swapping a partition config file.
If you use Elixir
Update Elixir to a release that includes the fix, per the Elixir release notes
Restrict local access on shared build machines and CI runners
Review build directories for unexpected partition config files
What the sources say 1
· Mastodon: “Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file.” Source