CVE-2026-35533
Trust-Control Bypass in Mise via Malicious .mise.toml File
Publication date: 2026-04-07
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jdx | mise | From 2026.2.18 (inc) to 2026.4.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects mise, a tool that manages development tools like node, python, cmake, and terraform. Between versions 2026.2.18 and 2026.4.5, mise loads trust-control settings from a local project file named .mise.toml before performing a trust check. An attacker who can place a malicious .mise.toml file in a repository can cause mise to treat that file as trusted. This allows the attacker to execute dangerous directives such as environment source commands, templates, hooks, or tasks.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary and potentially harmful commands or scripts within the development environment by leveraging the trusted .mise.toml file. This can lead to compromise of the development process, unauthorized code execution, and potentially full system compromise depending on the directives used.