CVE-2026-71477: Mise Dev Tools Privilege Escalation Flaw

CVE-2026-71477 Overview

CVE-2026-71477 affects mise, a developer tool manager used to install and manage runtimes like node, python, cmake, and terraform. The standalone installer script packaging/standalone/install.envsubst extracts release tar archives without normalizing file ownership. The archived mise/bin/mise binary records user and group ID 1001, and the installer moves the file to the target location while preserving those IDs. A local user holding UID/GID 1001 can subsequently replace a root-installed mise executable, particularly when MISE_INSTALL_PATH points at a shared directory such as /usr/local/bin. The issue is fixed in version 2026.7.1 [CWE-278: Insecure Default Permissions].

Critical Impact
A local user with UID/GID 1001 can overwrite a root-owned mise binary in a shared install path, enabling privilege escalation when other users invoke mise as root.

Affected Products

mise versions prior to 2026.7.1
Installations performed via the standalone installer script packaging/standalone/install.envsubst
Deployments where MISE_INSTALL_PATH targets shared locations such as /usr/local/bin

Discovery Timeline

2026-08-18 - CVE-2026-71477 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71477

Vulnerability Analysis

The vulnerability originates in the installer's handling of tar archive metadata. The release tarballs (.tar.xz, .tar.gz, .tar.zst) were built without --owner=0 --group=0, so archive entries recorded UID 1001 and GID 1001 from the build environment. When the installer extracted the archive, tar preserved those numeric IDs on the extracted files.

The installer then moved mise/bin/mise to $install_path without calling chown unless the installer itself ran as root. Even in the root case, chown 0:0 was applied only after the mv, and only conditionally. The result: a mise binary at /usr/local/bin/mise owned by UID/GID 1001, sitting inside a root-writable directory but writable by any local account mapped to UID 1001.

Root Cause

Two compounding defects produced the flaw. First, scripts/build-tarball.sh archived mise without normalizing owner and group entries. Second, install.envsubst used tar -xf without --no-same-owner and did not enforce chown 0:0 on the final path in all cases. Both are classic Insecure Default Permissions issues [CWE-278].

Attack Vector

Exploitation requires local access with UID or GID 1001, a mise standalone install performed to a shared path, and a subsequent invocation of mise by a higher-privileged user. The attacker overwrites the binary contents; the next root invocation executes attacker-controlled code.

text

   extract_dir="$(mktemp -d)"
   cd "$extract_dir"
   if [ "$ext" = "tar.zst" ] && ! tar_supports_zstd; then
-    zstd -d -c "$cache_file" | tar -xf -
+    zstd -d -c "$cache_file" | tar --no-same-owner -xf -
   else
-    tar -xf "$cache_file"
+    tar --no-same-owner -xf "$cache_file"
   fi
-  mv mise/bin/mise "$install_path"
   if [ "$(id -u)" = "0" ]; then
-    chown 0:0 "$install_path"
-    chmod 755 "$install_path"
+    chown 0:0 mise/bin/mise
+    chmod 755 mise/bin/mise
   fi
+  mv mise/bin/mise "$install_path"

Source: GitHub Commit b65dd67

The patch adds --no-same-owner to all tar extractions and reorders the ownership normalization to occur before the mv into $install_path.

Detection Methods for CVE-2026-71477

Indicators of Compromise

A mise binary in a shared path such as /usr/local/bin/mise owned by a non-root UID (notably UID 1001) rather than root:root
Modification timestamps on mise that do not match the original installation or upgrade window
Unexpected child processes spawned by mise when invoked by root or via sudo

Detection Strategies

Audit filesystem ownership across install paths: find /usr/local/bin /opt -name mise -not -user root -ls
Inventory installed mise versions and flag any host running a release prior to 2026.7.1
Compare the SHA-256 hash of installed mise binaries against the official release checksums published on GitHub

Monitoring Recommendations

Alert on write or rename operations targeting mise binaries in system directories by non-root UIDs
Log execve events for mise invoked with EUID 0 and correlate against the on-disk file owner
Track MISE_INSTALL_PATH values observed in shell histories and CI runners to identify shared-location installs

How to Mitigate CVE-2026-71477

Immediate Actions Required

Upgrade mise to version 2026.7.1 or later on all systems using the standalone installer
Verify ownership of any existing mise binary: it must be root:root when installed to a shared path
Reinstall mise from the patched release rather than only reapplying chown, to ensure binary integrity

Patch Information

The fix ships in mise2026.7.1. Two commits address the issue. Commit f1c28906 normalizes ownership at build time by passing --owner=0 --group=0 to tar in scripts/build-tarball.sh and adds a post-move chown 0:0 when the installer runs as root. Commit b65dd674 further hardens extraction by adding --no-same-owner to tar and applying ownership before the mv. See the GitHub Security Advisory GHSA-9mm4-fgvc-x7rp and the v2026.7.1 release notes.

Workarounds

Install mise to a per-user path such as ~/.local/bin instead of /usr/local/bin to remove the shared-target condition
Manually run chown 0:0 /usr/local/bin/mise && chmod 755 /usr/local/bin/mise after installation on unpatched hosts
Restrict the install.envsubst script to root-only execution and audit any local UID 1001 accounts

bash

# Post-install ownership normalization for unpatched mise installs
sudo chown 0:0 /usr/local/bin/mise
sudo chmod 755 /usr/local/bin/mise

# Verify
ls -l /usr/local/bin/mise
# Expected: -rwxr-xr-x 1 root root ... /usr/local/bin/mise