mise: Incorrect file ownership, when installed by the root user using `install.sh`
Priority LOW 31CWE-278Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-07
Fix Fixed mise (jdx): 2026.7.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA mise (jdx) Fixed in 2026.7.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71477
References
Other 6
- https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp
- https://github.com/jdx/mise/pull/10808
- https://github.com/jdx/mise/pull/10819
- https://github.com/jdx/mise/commit/b65dd674d75d9aa5c038b58a3a0cdb522cf258d5
- https://github.com/jdx/mise/commit/f1c28906f17af74430ff96f4438733c4a842c88d
- https://github.com/jdx/mise/releases/tag/v2026.7.1
More jdx vulnerabilities
- TI-2026-26027 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) CVSS 3.1CRITICAL 9.6
- TI-2026-74072 Untrusted local config in mise overrides default shell arguments CVSS 3.1HIGH 7.8
- TI-2026-27643 mise has a local settings bypass config trust checks CVSS 3.1HIGH 7.8
- TI-2026-40014 mise: Local credential_command executes untrusted config CVSS 3.1MEDIUM 6.3
- TI-2026-39395 mise HTTP backend uses raw version path for install symlink destination CVSS 3.1MEDIUM 5.5
- TI-2026-40009 mise: Arbitrary command execution via task-include files in an untrusted, config-less repository CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences