CVE-2026-35533
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.
Risk Assessment
The risk includes potential arbitrary code execution or dangerous actions in the project context, which could lead to compromise of the development environment.
Recommendation
Upgrade mise to a version later than 2026.4.5 and exercise caution when opening projects from untrusted sources.
Other vulnerabilities in mise
See all- CVE-2026-71477Medium
The mise tool, managing developer tool versions, before version 2026.7.1 records mise/bin/mise with user and group ID 1001, and the installation process does not normalize ownership, allowing a local user with those IDs to replace the installed executable, especially when MISE_INSTALL_PATH targets a shared location like /usr/local/bin.
- CVE-2026-33646Critical
The mise tool prior to version 2026.3.10 processes .tool-versions files through the Tera template engine with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode, allowing an attacker to place a malicious file in a git repository and execute commands without a trust prompt.
Original NVD description (English source)
mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.