CVE-2026-54557: jdx mise path traversal in HTTP backend symlink creation

CVE-2026-54557 · Severity: medium · CVSS 5.5 · Published 2026-06-26

mise is a tool used by developers to manage different versions of programming languages and utilities like Node.js and Python. A security flaw in how it handles tool installations allows a malicious project file to create files (symlinks) in unauthorized locations on a user's computer. This could allow an attacker to trick a developer into running malicious code by replacing legitimate system commands with malicious versions.

Technologies: mise (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-54557 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54557 being exploited in the wild.
How severe is CVE-2026-54557?
Medium severity, with a CVSS score of 5.5, published 26 June 2026.
Which products and versions are affected?
mise (crates.io) <= 2026.5.16, SEMVER:introduced=0,fixed=2026.6.1.
Is there a fix for CVE-2026-54557?
Yes. mise (crates.io): upgrade to 2026.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54557 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54557?
Check whether you run mise (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mise (crates.io): upgrade to 2026.6.1 or later
    cargo update -p mise

Technical details

A path traversal vulnerability exists in the mise HTTP backend's 'create_install_symlink' function in 'src/backend/http.rs'. The component fails to sanitize the version string from the '.tool-versions' file, which is an unprivileged project configuration file. On Unix-like systems, when an absolute path is provided as a version string, the 'PathBuf::join' operation discards the intended installation root, allowing symlinks to be created at arbitrary absolute paths. An attacker can leverage this to place executable symlinks in directories included in a user's PATH, leading to local code execution when a shadowed command is invoked. This is fixed in version 2026.6.1.

Affected products

  • jdx mise < 2026.6.1

Identifiers

  • CVE-2026-54557
  • GHSA-f94h-j2qg-fxw3

Timeline

  • 2026-06-12: advisory: GitHub Security Advisory published
  • 2026-06-26: disclosed: NVD publication date
  • 2026-06-26: patched: Fix released in version 2026.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.