TI-2026-40014 Aliases CVE-2026-55448 GHSA-29hf-rm4x-xxph

mise: Local credential_command executes untrusted config

MEDIUM 63CWE-78Published 2026-06-26 · Updated 2026-06-27

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set. This vulnerability is fixed in 2026.6.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix Fixed mise (jdx): 2026.6.4mise (crates.io): 2026.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jdx	mise	before 2026.6.4	2026.6.4	Patch available	CNA
—	mise (crates.io)	2026.3.15 to before 2026.6.4	2026.6.4	Patch available	GHSA-29hf-rm4x-xxph

mise Vendorjdx Affected before 2026.6.4 Fixed in 2026.6.4 Patch available CNA
mise (crates.io) Vendor— Affected 2026.3.15 to before 2026.6.4 Fixed in 2026.6.4 Patch available GHSA-29hf-rm4x-xxph

Remediation

Fix · CNA mise (jdx) Fixed in 2026.6.4
Fix · GHSA-29hf-rm4x-xxph mise (crates.io) Fixed in 2026.6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-55448
2026-10-03 Alias added: GHSA-29hf-rm4x-xxph
2026-11-03 1 new reference · GHSA-29hf-rm4x-xxph

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-55448

Other 2

TI-2026-26027 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) CVSS 3.1CRITICAL 9.6
TI-2026-74072 Untrusted local config in mise overrides default shell arguments CVSS 3.1HIGH 7.8
TI-2026-27643 mise has a local settings bypass config trust checks CVSS 3.1HIGH 7.8
TI-2026-39395 mise HTTP backend uses raw version path for install symlink destination CVSS 3.1MEDIUM 5.5
TI-2026-40009 mise: Arbitrary command execution via task-include files in an untrusted, config-less repository CVSS 3.1HIGH 8.6
TI-2026-50092 mise: Incorrect file ownership, when installed by the root user using `install.sh` CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences