TI-2026-27643 Aliases CVE-2026-35533 GHSA-436v-8fw5-4mj8

mise has a local settings bypass config trust checks

HIGH 69CWE-284Published 2026-04-07 · Updated 2026-04-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00166 5th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mise (crates.io): 2026.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jdx	mise	2026.2.18 – 2026.4.5	—	No fix listed	CNA
—	mise (crates.io)	2026.2.18 to before 2026.6.4	2026.6.4	Patch available	GHSA-436v-8fw5-4mj8

mise Vendorjdx Affected 2026.2.18 – 2026.4.5 Fixed in — No fix listed CNA
mise (crates.io) Vendor— Affected 2026.2.18 to before 2026.6.4 Fixed in 2026.6.4 Patch available GHSA-436v-8fw5-4mj8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jdx:mise::::::rust::*	2026.2.18 – 2026.4.5	Vulnerable	jdx

cpe:2.3:a:jdx:mise:*:*:*:*:*:rust:*:* Versions 2026.2.18 – 2026.4.5 Vulnerable ·jdx

Remediation

Fix · GHSA-436v-8fw5-4mj8 mise (crates.io) Fixed in 2026.6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35533
2026-10-03 Alias added: GHSA-436v-8fw5-4mj8

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences