TI-2026-39395 Aliases CVE-2026-54557 GHSA-f94h-j2qg-fxw3

mise HTTP backend uses raw version path for install symlink destination

MEDIUM 58CWE-22Published 2026-06-26 · Updated 2026-06-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00183 7th percentileScored 2026-11-07

Fix Fixed mise (jdx): 2026.6.1mise (crates.io): 2026.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jdx	mise	before 2026.6.1	2026.6.1	Patch available	CNA
—	mise (crates.io)	before 2026.6.1	2026.6.1	Patch available	GHSA-f94h-j2qg-fxw3

mise Vendorjdx Affected before 2026.6.1 Fixed in 2026.6.1 Patch available CNA
mise (crates.io) Vendor— Affected before 2026.6.1 Fixed in 2026.6.1 Patch available GHSA-f94h-j2qg-fxw3

Remediation

Fix · CNA mise (jdx) Fixed in 2026.6.1
Fix · GHSA-f94h-j2qg-fxw3 mise (crates.io) Fixed in 2026.6.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54557
2026-10-03 Alias added: GHSA-f94h-j2qg-fxw3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-54557

Other 2

TI-2026-26027 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) CVSS 3.1CRITICAL 9.6
TI-2026-74072 Untrusted local config in mise overrides default shell arguments CVSS 3.1HIGH 7.8
TI-2026-27643 mise has a local settings bypass config trust checks CVSS 3.1HIGH 7.8
TI-2026-40014 mise: Local credential_command executes untrusted config CVSS 3.1MEDIUM 6.3
TI-2026-40009 mise: Arbitrary command execution via task-include files in an untrusted, config-less repository CVSS 3.1HIGH 8.6
TI-2026-50092 mise: Incorrect file ownership, when installed by the root user using `install.sh` CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences