Arbitrary Command Execution Vulnerability in mise Dev Tools

CVE-2026-55441

What is CVE-2026-55441?

The mise tool, which manages development environments for languages like Node, Python, CMake, and Terraform, has a vulnerability that enables arbitrary command execution. The issue arises in versions prior to 2026.6.4, where the application's trust settings do not properly gate certain configuration files. Specifically, if a directory includes task files without having a corresponding config file, the application defaults to insecure behavior, allowing commands to be executed without user consent. This exploit can be initiated simply by listing tasks or utilizing shell tab completion when navigating into a clone repository. The vulnerability has been addressed in version 2026.6.4.

References