jdx mise up to 2026.6.0 HTTP Backend PathBuf::join path traversal

Summaryinfo

A vulnerability was found in jdx mise up to 2026.6.0. It has been classified as critical. This issue affects the function PathBuf::join of the component HTTP Backend. This manipulation causes path traversal. This vulnerability appears as CVE-2026-54557. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in jdx mise up to 2026.6.0 and classified as critical. Affected by this vulnerability is the function PathBuf::join of the component HTTP Backend. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54557 since 06/15/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 2026.6.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• jdx

Name

• mise

Version

• 2026.0
• 2026.1
• 2026.2
• 2026.3
• 2026.4
• 2026.5
• 2026.6.0

Website

• Product: https://github.com/jdx/mise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion