CVE-2026-54557 Details
Description
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.
A vulnerability in the mise HTTP backend prior to version 2026.6.1 allows for the creation of symbolic links outside the intended installation directory. This issue arises because the HTTP backend uses the raw version string to determine the symlink destination, rather than a sanitized version suitable for file paths. On Unix-like systems, if the version string is an absolute path, it can lead to the symlink being created outside the mise install tree. Additionally, if the 'bin_path' option is used, an executable symlink can be placed under a user-selected absolute prefix, potentially leading to execution of the linked binary if the prefix is included in the system's PATH.
Users should update to mise version 2026.6.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jdx mise | <= 2026.5.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | New CVE Received | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |