Arbitrary Command Execution in Mise Development Tool by JDX

CVE-2026-33646

What is CVE-2026-33646?

Mise, a development tooling management platform by JDX, is susceptible to a vulnerability that allows arbitrary command execution via improperly secured .tool-versions files. Prior to the release of version 2026.3.10, the Tera template engine used during the parsing process inadvertently registered the exec() function without stringent trust verification for these files in non-paranoid mode. An attacker could exploit this by placing a malicious .tool-versions file within a git repository. When a user activates Mise and navigates to the corresponding directory, the system executes arbitrary commands without prompting for trust verification. This significant oversight highlights the importance of secure file handling in development environments and has been addressed in the updated version.

References