mise: Local configuration overrides default shell arguments
Summary
mise, a tool manager for development tools such as node, python and terraform, read default shell interpreter arguments from an untrusted local .mise.toml before the project was trusted. An attacker-controlled repository could therefore run arbitrary commands with the developer's account privileges when a trusted task or install step fell back to the default shell. The vulnerability requires that a user opens the repository and runs a trusted task or install.
Affected
- jdx mise, all versions before 2026.7.14
Fixed in
- Upgrade to mise 2026.7.14 or later
Workaround
- Unknown.
- Do not run mise in untrusted repositories and do not accept trust prompts for unknown .mise.toml files until the update is installed.
Exploitation
- CISA SSVC: exploitation status 'poc', not automatable.
- No evidence of exploitation in the wild found.
- CISA KEV: not listed.
Our recommendation
- Upgrade mise on developer workstations, CI runners and build servers to 2026.7.14 or later.
- Check whether your distribution or package manager ships an older mise version.
- Avoid running mise in unknown repositories until patched.
- Review systems where mise is used for signs of unexpected command execution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g74g-rg72-j2p3 github.com
- Fix commit c6cd7a9 github.com
- Pull request #11293 github.com
- mise release v2026.7.14 github.com
- OSV GHSA-g74g-rg72-j2p3 osv.dev
- OpenCVE CVE-2026-103929 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:58.
Original description (NVD)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.
NVD references (5)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.