In the Mix dependency compilation system, a hash of project configuration is written to a file in a temporary directory that is shared across all partitions. Because the directory creation step does not verify ownership, a local user can create or replace that file before the worker processes read it. This allows the attacker to insert arbitrary code that will be executed as the owner of the target user, effectively giving the attacker the ability to run code as that user. The flaw is a classic insecure temporary file vulnerability and is classified as CWE-377.

The vulnerability affects the Elixir programming language, specifically Elixir’s Mix tool, from version 1.20.0‑rc.4 up to and including 1.20.4. It is relevant to any system that runs Elixir Mix tasks for dependency compilation on a multi‑user host.

The CVSS base score is 5.4, indicating moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there have not been widely reported exploits yet. The likely attack vector requires the attacker to have a user account on the same host and to be able to run Mix commands, making it a local privilege escalation scenario.