mise vulnerabilities
CVEs whose affected-version data names the mise package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-103929High· 7.8PoCmise manages dev tools like node, python, cmake, and terraform
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings remove…
CVE-2026-54557Medium· 5.5mise HTTP backend uses raw version path for install symlink destination
mise HTTP backend uses raw version path for install symlink destination
CVE-2026-55441High· 8.6Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository
Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository
CVE-2026-55448Medium· 6.3Mise's local credential_command executes untrusted config
Mise's local credential_command executes untrusted config
CVE-2026-33646Critical· 9.6Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)