Executive brief
mise is a tool used by developers to manage different versions of programming languages and utilities like Node.js and Python. A security flaw in how it handles tool installations allows a malicious project file to create files (symlinks) in unauthorized locations on a user's computer. This could allow an attacker to trick a developer into running malicious code by replacing legitimate system commands with malicious versions.
Technical details
A path traversal vulnerability exists in the mise HTTP backend's 'create_install_symlink' function in 'src/backend/http.rs'. The component fails to sanitize the version string from the '.tool-versions' file, which is an unprivileged project configuration file. On Unix-like systems, when an absolute path is provided as a version string, the 'PathBuf::join' operation discards the intended installation root, allowing symlinks to be created at arbitrary absolute paths. An attacker can leverage this to place executable symlinks in directories included in a user's PATH, leading to local code execution when a shadowed command is invoked. This is fixed in version 2026.6.1.
Affected products
- jdx mise < 2026.6.1
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-26: patched: Fix released in version 2026.6.1