CVE-2026-55448 Details
Description
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set. This vulnerability is fixed in 2026.6.4.
A vulnerability in the mise tool, which manages development utilities like Node.js, Python, CMake, and Terraform, allows for arbitrary command execution. This issue arises from the way mise handles the GitHub.credential_command setting in local project configuration. Between versions 2026.3.15 and 2026.6.4, mise executed this command without prior trust validation, using a shell command execution approach, when resolving GitHub tokens. An attacker could exploit this by placing a .mise.toml file in a repository, executing commands on behalf of the user when certain GitHub token environment variables were not set. The vulnerability has been patched in version 2026.6.4.
Users can update to mise version 2026.6.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jdx/mise | >= 2026.3.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |