CVE-2026-55448: mise Local Code Execution via Malicious .mise.toml

Technical summary

The vulnerability stems from incorrect initialization order in mise's credential resolution logic. When resolving GitHub credentials, mise loads the github.credential_command setting from the local project .mise.toml file and passes it to a shell invocation (sh -c) before performing any trust or sandbox checks. This is a classic local code execution issue (CWE-78: OS Command Injection). The attack surface is local but the trigger is user-initiated: an attacker must convince a developer to run a GitHub-related command in a directory containing a malicious .mise.toml. Environment variable precedence provides a partial mitigation—if GITHUB_TOKEN or similar is set in the user's shell, those are consulted first—but this is not guaranteed and does not block the vulnerability.

Business impact

For development teams, this is a supply-chain vector. An attacker can poison a public repository or an internal fork with a .mise.toml file that executes arbitrary commands (data exfiltration, credential theft, malware installation) when a developer pulls the repository and runs any GitHub-related mise operation. In organizations where mise is standard tooling across teams, a single compromised repository could compromise multiple developer machines. The impact is heightened in CI/CD environments if those systems run mise without explicit token configuration, though automated systems are generally less attractive targets than human developers (who have access to additional credentials and secrets).

Affected systems

mise versions 2026.3.15, 2026.4.x, 2026.5.x, and 2026.6.0 through 2026.6.3 are affected. Any developer or CI system running these versions and executing GitHub-related mise commands in repositories they do not fully control is at risk. mise itself is widely used in development communities but is not universally deployed, so the blast radius depends on your organization's tooling choices.

Exploitability

Exploitability is rated MEDIUM (CVSS 6.3) because several conditions must align: the attacker must place a .mise.toml in a repository the victim will work in, the victim must run a GitHub-related mise command, and the victim must not have a higher-priority GitHub token environment variable set. This rules out opportunistic remote attacks but makes targeted attacks on development teams feasible. No user interaction is required beyond normal development workflows (running mise commands), and the attack is local-only, limiting spread.

Remediation

Upgrade mise to version 2026.6.4 or later immediately. This release corrects the initialization order, ensuring that trust decisions and environment variable precedence are evaluated before any local .mise.toml is loaded. For teams unable to upgrade immediately, mitigate by: (1) ensuring GITHUB_TOKEN or GH_TOKEN environment variables are set in your development shells and CI environments, and (2) code-reviewing all .mise.toml files in repositories before running mise commands.

Patch guidance

Update mise to 2026.6.4 or any subsequent version. Verify the version with `mise --version`. If you use a package manager (Homebrew, apt, cargo, etc.), check your package source for the latest available version; some distributions may lag behind the official release. Retest any GitHub-related mise workflows (authentication, token resolution) after patching to confirm normal operation.

Detection guidance

Look for evidence of untrusted .mise.toml files in recently cloned repositories. If you have shell history or audit logs, search for mise commands executed in repositories you do not own or maintain. In CI/CD logs, check for unexpected script execution or network connections around the time of GitHub-related mise commands. Endpoint detection tools should flag shell invocations launched from mise with suspicious or unexpected arguments.

Why prioritize this

While not yet in CISA's KEV catalog, this should be prioritized for patches because: (1) the fix is available and non-disruptive (a simple upgrade), (2) the attack is practical for targeted supply-chain scenarios, and (3) mise is increasingly common in development environments. Organizations heavily reliant on mise should patch within days; others should queue it for the next maintenance window. The MEDIUM CVSS score reflects that user interaction (running a command) is required, but that should not be mistaken for low urgency—developers routinely run mise commands.

Risk score, explained

CVSS 6.3 (MEDIUM severity) accounts for: High Impact (Confidentiality: H, Integrity: H) because arbitrary code execution can steal credentials or modify project state; Local Attack Vector because the .mise.toml must be in the local filesystem; High Attack Complexity (AC:H) because the attacker must control a repository the victim will work in and the victim must run a specific command; and User Interaction (UI:R) because a developer must actively invoke mise. No Availability impact because the attack does not typically crash systems. The score correctly reflects that this is serious but not critical—it requires user action and local access but delivers powerful code execution.

Frequently asked questions