mise: Arbitrary command execution via task-include files in an untrusted, config-less repository

published 2026-06-23 4 mo ago modified 2026-10-25 14 d ago also GHSA-77g9-363w-rccq , EUVD-2026-39815

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera fields — and that tera environment has exec() registered. A {{ exec(command='…') }} in any rendered field runs arbitrary commands the moment the tasks are merely listed. There's no config file to gate on, so no trust prompt ever appears. Read-only commands trigger it: mise tasks, mise task ls, mise run, mise tasks --usage (the query shell completion runs on Tab). The victim only has to cd into a cloned repo and list or tab-complete a task. This vulnerability is fixed in 2026.6.4.

Patch / fix

fixed in 1

crates.io mise 2026.6.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-26)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub	3.1	8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	mise	<2026.6.4	2026.6.4

Affected products

jdx mise

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-94 Improper Control of Generation of Code
CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary