CVE-2026-71477
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The mise tool, managing developer tool versions, before version 2026.7.1 records mise/bin/mise with user and group ID 1001, and the installation process does not normalize ownership, allowing a local user with those IDs to replace the installed executable, especially when MISE_INSTALL_PATH targets a shared location like /usr/local/bin.
Risk Assessment
A local user with IDs 1001 can take control of the mise executable, potentially leading to privilege escalation or running malicious code in an administrator context.
Recommendation
Update mise to version 2026.7.1 or later, which includes a fix normalizing file ownership during installation.
Other vulnerabilities in mise
See all- CVE-2026-33646Critical
The mise tool prior to version 2026.3.10 processes .tool-versions files through the Tera template engine with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode, allowing an attacker to place a malicious file in a git repository and execute commands without a trust prompt.
- CVE-2026-35533High
mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.
Original NVD description (English source)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS