CVE-2026-33646 Details
Description
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This means an attacker can place a malicious .tool-versions file in a git repository, and when a victim with mise activated cds into the directory, arbitrary commands execute without any trust prompt. This vulnerability is fixed in 2026.3.10.
A critical vulnerability in Mise versions prior to 2026.3.10 allows for arbitrary code execution through the improper handling of .tool-versions files. These files are processed by the Tera template engine without appropriate trust verification, enabling attackers to execute commands on the victim's machine. The issue arises because, unlike .mise.toml files, .tool-versions files are not verified for trust in non-paranoid mode. As a result, an attacker can introduce a malicious .tool-versions file into a git repository, and when a user with Mise activated navigates into the directory, the embedded commands are executed without any trust prompt.
Users can update to Mise version 2026.3.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jdx/mise/security/advisories/GHSA-fjj5-v948-whjj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/jdx/mise/security/advisories/GHSA-fjj5-v948-whjj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jdx mise | < 2026.3.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |