Symlink Vulnerability in mise Affects Development Tool Management
CVE-2026-54557

5.5MEDIUM

Key Information:

Vendor

Jdx

Status
Mise
Vendor
CVE Published:
26 June 2026

What is CVE-2026-54557?

A symlink vulnerability exists in the mise tool management system, impacting versions prior to 2026.6.1. The mise HTTP backend erroneously constructs symlink destinations from the raw version string for non-latest installs. This can lead to unsafe symlink creation outside of the designated mise installation directory on Unix-like systems. An attacker can exploit this vulnerability by manipulating a .tool-versions file, enabling installation paths that may compromise the security of the development environment. The issue is addressed in version 2026.6.1.

Affected Version(s)

mise < 2026.6.1

References

https://github.com/jdx/mise/security/advisories/GHSA-f94h...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.