Trust-Control Bypass in Mise via Malicious .mise.toml File

Publication date: 2026-04-07

Last updated on: 2026-04-15

Assigner: GitHub, Inc.

Description

mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-07

Last Modified

2026-04-15

Generated

2026-07-06

AI Q&A

2026-04-08

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35533

Affected Vendors & Products

Vendor	Product	Version / Range
jdx	mise	From 2026.2.18 (inc) to 2026.4.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects mise, a tool that manages development tools like node, python, cmake, and terraform. Between versions 2026.2.18 and 2026.4.5, mise loads trust-control settings from a local project file named .mise.toml before performing a trust check. An attacker who can place a malicious .mise.toml file in a repository can cause mise to treat that file as trusted. This allows the attacker to execute dangerous directives such as environment source commands, templates, hooks, or tasks.

Impact Analysis

If exploited, this vulnerability can allow an attacker to execute arbitrary and potentially harmful commands or scripts within the development environment by leveraging the trusted .mise.toml file. This can lead to compromise of the development process, unauthorized code execution, and potentially full system compromise depending on the directives used.

Hi! I’m here to help you understand CVE-2026-35533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70