CVE-2026-55441: mise Dev Tools Manager RCE Vulnerability

CVE-2026-55441 Overview

mise is a development tool manager for languages and utilities including node, python, cmake, and terraform. CVE-2026-55441 is a command injection vulnerability [CWE-78] in mise versions prior to 2026.6.4. The flaw bypasses mise's trust_check gating mechanism through task-include files. When a repository contains a task directory such as mise-tasks/, .mise/tasks/, or similar without a mise.toml config file, mise skips the trust prompt and renders each task's Tera template fields. Because the Tera environment registers the exec() function, a crafted task can execute arbitrary commands when a victim merely lists or tab-completes tasks.

Critical Impact
Arbitrary command execution triggers from read-only actions such as mise tasks, mise task ls, mise run, or shell tab-completion after a user runs cd into a cloned repository.

Affected Products

mise versions prior to 2026.6.4
Repositories containing mise-tasks/ or .mise/tasks/ directories without a mise.toml file
Shells with mise tab-completion enabled for mise run

Discovery Timeline

2026-06-26 - CVE-2026-55441 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-55441

Vulnerability Analysis

mise implements a trust model that gates execution of untrusted config files. The trust_check function evaluates mise.toml and .tool-versions files before their contents run. Task-include files stored in directories such as mise-tasks/ and .mise/tasks/ follow a separate code path that never invokes trust_check. When mise discovers a task directory without an accompanying config file, it applies default includes and immediately renders each task's Tera template fields. The Tera environment exposes an exec() helper that runs shell commands during template rendering, so any expression of the form {{ exec(command='…') }} in a task field executes when tasks are enumerated.

Root Cause

The root cause is a missing trust boundary. The trust gate applies to config files but not to task-include files loaded through the default include path. mise renders Tera templates before the user consents to execute anything from the repository. The exec() function should not be reachable in an untrusted rendering context.

Attack Vector

An attacker publishes a repository containing a task-include directory with a malicious task field. The victim clones the repository and changes into the directory. Any of the following read-only commands trigger execution: mise tasks, mise task ls, mise run, or mise tasks --usage. Shell tab-completion invokes the query path on Tab, so pressing Tab after typing mise run is sufficient. No config file exists to trigger the trust prompt, so the victim receives no warning.

See the GitHub Security Advisory GHSA-77g9-363w-rccq for technical details.

Detection Methods for CVE-2026-55441

Indicators of Compromise

Repositories containing mise-tasks/, .mise/tasks/, or similar task directories without a mise.toml config file
Task files containing {{ exec(command='...') }} Tera expressions in any rendered field
Unexpected child processes spawned by the mise binary shortly after a cd into a cloned repository
Outbound network connections initiated during mise tasks or shell tab-completion events

Detection Strategies

Scan cloned repositories for task-include directories and inspect task field contents for Tera exec() calls before running mise commands
Monitor process trees on developer workstations for mise spawning shells, curl, wget, or interpreters such as python and bash
Alert on mise version strings older than 2026.6.4 reported by endpoint inventory

Monitoring Recommendations

Log command-line arguments and parent-child process relationships for the mise binary across developer endpoints
Baseline outbound network activity from developer shells and flag connections that correlate with mise tasks invocations
Track repository clone events and correlate them with subsequent execution of dev tool managers

How to Mitigate CVE-2026-55441

Immediate Actions Required

Upgrade mise to version 2026.6.4 or later on all developer workstations and build agents
Audit recently cloned repositories for mise-tasks/ or .mise/tasks/ directories and inspect task fields for exec() expressions
Disable mise shell tab-completion until upgrades complete to prevent inadvertent triggering

Patch Information

The vulnerability is fixed in mise 2026.6.4. The release closes the trust gap by routing task-include files through the trust boundary. Refer to the GitHub Security Advisory GHSA-77g9-363w-rccq for full patch details.

Workarounds

Avoid running mise tasks, mise task ls, mise run, or mise tasks --usage in untrusted repositories until the upgrade is applied
Remove or rename task directories such as mise-tasks/ and .mise/tasks/ in cloned repositories before invoking mise
Disable shell tab-completion for mise to prevent completion queries from rendering untrusted tasks

bash

# Configuration example
# Upgrade mise to the patched release
mise self-update

# Verify the installed version is 2026.6.4 or later
mise --version