Vulnerability in mise Dev Tools Affects Local Project Security

CVE-2026-103929

What is CVE-2026-103929?

The mise development tools, used for managing environments like Node, Python, CMake, and Terraform, have a vulnerability wherein untrusted local project settings are loaded without adequate security measures. Prior to version 2026.7.14, in its default non-safe mode, mise improperly allowed local configurations to influence the execution of trusted tasks. Specific settings were not marked with the necessary restrictions, enabling an attacker to manipulate interpreter arguments for commands executed with the privileges of the developer account. This exploitation could occur despite local configuration not receiving trust approval, posing a significant security risk. The issue has been addressed in version 2026.7.14, which strengthens the integrity of trusted commands.

References