Arbitrary Command Execution Vulnerability in Mise Dev Tools
CVE-2026-55448

6.3MEDIUM

Key Information:

Vendor

Jdx

Status
Mise
Vendor
CVE Published:
26 June 2026

What is CVE-2026-55448?

The Mise Dev Tools, which manage various development environments such as node, python, cmake, and terraform, contain a vulnerability that allows arbitrary command execution. Specifically, from version 2026.3.15 to 2026.6.4, Mise improperly loads the 'github.credential_command' from local project configurations before validating trust decisions. An attacker can exploit this flaw by placing a malicious '.mise.toml' file in a repository. When a user runs any GitHub-related Mise command without a higher-priority GitHub token environment variable, the application executes the commands contained in the malicious file, potentially leading to unauthorized actions on the system. This vulnerability has been addressed and fixed in version 2026.6.4.

Affected Version(s)

mise < 2026.6.4

References

https://github.com/jdx/mise/security/advisories/GHSA-29hf...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.