CVE-2026-55441

{
  "id": "CVE-2026-55441",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T18:17:01.190",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera fields — and that tera environment has exec() registered. A {{ exec(command='…') }} in any rendered field runs arbitrary commands the moment the tasks are merely listed. There's no config file to gate on, so no trust prompt ever appears. Read-only commands trigger it: mise tasks, mise task ls, mise run, mise tasks --usage (the query shell completion runs on Tab). The victim only has to cd into a cloned repo and list or tab-complete a task. This vulnerability is fixed in 2026.6.4."
    },
    {
      "lang": "es",
      "value": "mise gestiona herramientas de desarrollo como node, python, cmake y terraform. Antes de la versión 2026.6.4, la función de confianza de mise controla los archivos de configuración (mise.toml, .tool-versions) a través de trust_check, pero los archivos de inclusión de tareas se cargan en una ruta que nunca la alcanza. Cuando un directorio tiene un directorio de inclusión de tareas (mise-tasks/, .mise/tasks/, ...) pero ningún archivo de configuración, mise recurre a las inclusiones predeterminadas y renderiza los campos tera de cada tarea - y ese entorno tera tiene exec() registrado. Un {{ exec(command=’...’) }} en cualquier campo renderizado ejecuta comandos arbitrarios en el momento en que las tareas son simplemente listadas. No hay archivo de configuración para controlar, por lo que nunca aparece una solicitud de confianza. Los comandos de solo lectura lo activan: mise tasks, mise task ls, mise run, mise tasks --usage (la finalización de la consulta de shell se ejecuta al presionar Tab). La víctima solo tiene que hacer cd en un repositorio clonado y listar o autocompletar una tarea. Esta vulnerabilidad está corregida en la versión 2026.6.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jdx",
          "product": "mise",
          "versions": [
            {
              "version": "< 2026.6.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T18:14:26.577413Z",
          "id": "CVE-2026-55441",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jdx/mise/security/advisories/GHSA-77g9-363w-rccq",
      "source": "[email protected]"
    }
  ]
}