PT-2026-51640 · Mise · Mise
Published
2026-06-23
·
Updated
2026-06-26
·
CVE-2026-55441
CVSS v3.1
8.6
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
mise versions prior to 2026.6.4
Description
A flaw in the trust mechanism allows arbitrary command execution when a directory contains task-include directories (such as
mise-tasks/, .mise/tasks/, etc.) but lacks a configuration file. In this scenario, the software falls back to default includes and renders task fields using the Tera template engine, which has the exec() function registered. An attacker can place a {{ exec(command='...') }} sequence in any rendered field of a task file, which will execute automatically when the tasks are listed or accessed. This occurs without triggering a trust prompt because the loading path bypasses the trust check function. The issue can be triggered by read-only commands such as mise tasks, mise task ls, mise run, and mise tasks --usage, or via shell completion when pressing Tab.Recommendations
Update mise to version 2026.6.4 or later.
Fix
Incorrect Permission
Code Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mise