CVE-2026-33646: mise Dev Tools Manager RCE Vulnerability

CVE-2026-33646 Overview

CVE-2026-33646 is a code injection vulnerability in mise, a development tool version manager for languages and utilities such as Node.js, Python, CMake, and Terraform. Versions prior to 2026.3.10 process .tool-versions files through the Tera template engine with the exec() function registered. This design allows arbitrary command execution during file parsing. Unlike .mise.toml files, .tool-versions files bypass trust verification in non-paranoid mode. An attacker who plants a malicious .tool-versions file in a git repository can trigger command execution when a victim with mise activated enters the directory. The issue is fixed in version 2026.3.10 and is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Attackers achieve arbitrary command execution on developer workstations simply by having victims cd into a repository containing a malicious .tool-versions file.

Affected Products

mise versions prior to 2026.3.10
Any environment with mise shell activation enabled
Developer workstations that clone or navigate untrusted repositories

Discovery Timeline

2026-06-26 - CVE-2026-33646 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-33646

Vulnerability Analysis

The vulnerability originates in how mise parses .tool-versions configuration files. The parser routes file contents through the Tera template engine, a Rust-based templating library. During template evaluation, mise registers the exec() function, which executes arbitrary shell commands. Any expression embedded in a .tool-versions file that invokes exec() runs during parsing.

.mise.toml files require trust verification before execution. .tool-versions files skip this check in non-paranoid mode. This asymmetric trust model creates the exploitation path. When a developer activates mise in their shell and changes directories into a repository, mise automatically reads .tool-versions. Template evaluation runs commands under the user's identity without prompting.

Root Cause

The root cause is unsafe template engine configuration. The exec() function should not be registered for parsing untrusted configuration files. Combined with the missing trust prompt for .tool-versions files, this exposes users to code execution from any repository they navigate.

Attack Vector

An attacker commits a .tool-versions file containing a Tera template expression that invokes exec(). The attacker distributes the repository through GitHub, package registries, or supply chain channels. When a developer clones the project and enters the directory with mise activated, the template engine evaluates the payload. Commands execute in the developer's shell context with access to credentials, SSH keys, and cloud tokens. User interaction is limited to navigating into the directory, satisfying the UI:R requirement in the CVSS vector.

For technical specifics on the payload format and affected code paths, refer to the GitHub Security Advisory GHSA-fjj5-v948-whjj.

Detection Methods for CVE-2026-33646

Indicators of Compromise

.tool-versions files containing Tera template syntax such as {{ or {% combined with exec( calls
Unexpected child processes spawned by mise during directory changes
Outbound network connections initiated shortly after cd operations on newly cloned repositories
New shell history entries, cron jobs, or SSH keys added without user action

Detection Strategies

Scan source repositories for .tool-versions files containing template delimiters or exec invocations
Audit mise version across developer fleets and flag installations below 2026.3.10
Monitor process ancestry for shells or interpreters launched by mise outside expected tool-install workflows

Monitoring Recommendations

Log directory-change events combined with mise process activity on developer endpoints
Alert on mise spawning bash, sh, python, curl, or wget as child processes
Track file writes to sensitive locations following repository navigation events

How to Mitigate CVE-2026-33646

Immediate Actions Required

Upgrade mise to version 2026.3.10 or later on all developer workstations and CI runners
Inventory local repositories for suspicious .tool-versions files before entering their directories
Rotate credentials, tokens, and SSH keys on any host that may have parsed an untrusted .tool-versions file

Patch Information

The maintainer released the fix in mise version 2026.3.10. The patched release removes the exploitation path by changing how .tool-versions files are processed. Review the GitHub Security Advisory for release notes and upgrade guidance.

Workarounds

Enable paranoid mode in mise configuration to enforce trust verification on all configuration files
Disable automatic mise shell activation until the upgrade completes
Restrict mise usage to vetted repositories and avoid navigating untrusted project directories

bash

# Upgrade mise to the patched release
mise self-update

# Verify installed version meets or exceeds 2026.3.10
mise --version