CVE-2026-103929 in mise
Summary
by MITRE • 10/14/2026
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in mise, a development tool manager that handles various runtime environments such as Node.js, Python, CMake, and Terraform, represents a critical security flaw related to configuration trust boundaries. In its default non-safe mode, the application processes .mise.toml configuration files from local projects before any explicit user approval or trust verification has occurred. This design choice creates an opportunity for malicious actors to exploit the initial loading phase of the toolchain. Specifically, the function responsible for stripping untrusted settings, known as strip_local_only_settings, was implemented with a narrow scope that only removed fields explicitly marked as global_only. However, several critical configuration parameters governing shell execution were not included in this protected list. These include unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args. Because these settings lacked the global_only designation, they remained active during the pre-trust processing stage, allowing a repository's local configuration to override default system behaviors without user consent or verification.
The technical mechanism of this flaw relies on command injection through argument manipulation rather than direct code execution within the tool itself. When mise prepares to execute tasks that do not specify an explicit shell, postinstall directive, template exec operation, or hook, it falls back to a default shell configuration. The vulnerability allows an attacker-controlled repository to inject specific interpreter arguments into this fallback mechanism. Crucially, when mise appends the trusted command provided by the developer after these attacker-controlled interpreter arguments, the resulting execution chain prioritizes the injected arguments first. This sequence enables the arbitrary command specified in the malicious local configuration to execute with the privileges of the currently logged-in developer account. The impact is severe because it bypasses the intended security model where users must explicitly trust a project's configuration before its settings influence system behavior.
From an operational perspective, this vulnerability poses significant risks including unauthorized code execution, privilege escalation if combined with other local vulnerabilities, and potential compromise of development environments or CI/CD pipelines that rely on mise for dependency management. An attacker could craft a malicious repository containing a .mise.toml file designed to exploit this flaw. When another developer clones the repository and runs any command that triggers the default shell fallback within mise's non-safe mode, the injected payload executes immediately. This undermines the integrity of development workflows and can lead to data exfiltration or further lateral movement within an organization's infrastructure if the compromised account has access to sensitive resources. The issue is classified under CWE-94 as Improper Control of Generation of Code Command Injection, specifically involving untrusted input influencing command construction. Additionally, it aligns with MITRE ATT&CK technique T1059, which covers Command and Scripting Interpreter abuse, highlighting the risk of executing arbitrary commands through manipulated configuration files.
The resolution for this vulnerability was implemented in version 2026.7.14 by ensuring that all shell-related default arguments are properly handled during the trust verification process or marked appropriately to prevent pre-trust modification. To mitigate similar risks in environments where upgrading is not immediately feasible, developers should avoid using mise's non-safe mode with untrusted repositories until the patch is applied. It is also recommended to enforce strict code review practices for any .mise.toml files introduced into shared projects and to consider adopting safe modes by default if supported by organizational policies. The separate path-sanitization hardening mentioned in related advisories addresses a different vector and does not mitigate this specific configuration trust bypass, emphasizing the need for targeted updates addressing shell argument handling specifically.