# CVE-2026-54557: jdx mise path traversal in HTTP backend symlink creation

Source: https://junglewise.ai/threats/cve-2026-54557-jdx-mise-path-traversal-in-http-backend-symlink-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-54557 · Severity: medium · CVSS 5.5 · Published 2026-06-26

mise is a tool used by developers to manage different versions of programming languages and utilities like Node.js and Python. A security flaw in how it handles tool installations allows a malicious project file to create files (symlinks) in unauthorized locations on a user's computer. This could allow an attacker to trick a developer into running malicious code by replacing legitimate system commands with malicious versions.

Technologies: [mise (crates.io)](https://junglewise.ai/threats/technologies/mise). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-54557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54557 being exploited in the wild.

**How severe is CVE-2026-54557?** Medium severity, with a CVSS score of 5.5, published 26 June 2026.

**Which products and versions are affected?** mise (crates.io) <= 2026.5.16, SEMVER:introduced=0,fixed=2026.6.1.

**Is there a fix for CVE-2026-54557?** Yes. mise (crates.io): upgrade to 2026.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54557 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54557?** Check whether you run mise (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mise (crates.io): upgrade to 2026.6.1 or later

  ```sh
  cargo update -p mise
  ```


## Technical details

A path traversal vulnerability exists in the mise HTTP backend's 'create_install_symlink' function in 'src/backend/http.rs'. The component fails to sanitize the version string from the '.tool-versions' file, which is an unprivileged project configuration file. On Unix-like systems, when an absolute path is provided as a version string, the 'PathBuf::join' operation discards the intended installation root, allowing symlinks to be created at arbitrary absolute paths. An attacker can leverage this to place executable symlinks in directories included in a user's PATH, leading to local code execution when a shadowed command is invoked. This is fixed in version 2026.6.1.

## Affected products

- jdx mise < 2026.6.1

## Identifiers

- CVE-2026-54557
- GHSA-f94h-j2qg-fxw3

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-26: patched: Fix released in version 2026.6.1

## References

- [https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3](https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3)

## Related threats

- [mise untrusted local configuration shell argument injection](https://junglewise.ai/threats/cve-2026-103929-mise-permits-untrusted-local-configuration-to-override-default)
- [jdx mise OS command injection in github.credential_command](https://junglewise.ai/threats/cve-2026-55448-jdx-mise-os-command-injection-in-github-credential-command)
- [jdx mise arbitrary command execution via task-include files](https://junglewise.ai/threats/cve-2026-55441-jdx-mise-arbitrary-command-execution-via-task-include-files)
- [jdx mise arbitrary command execution in .tool-versions parsing](https://junglewise.ai/threats/cve-2026-33646-jdx-mise-arbitrary-command-execution-in-tool-versions-parsing)
- [jdx mise trust check bypass in local configuration files](https://junglewise.ai/threats/cve-2026-35533-jdx-mise-trust-check-bypass-in-local-configuration-files)