CVE-2026-35533
Received Received - Intake
Trust-Control Bypass in Mise via Malicious .mise.toml File

Publication date: 2026-04-07

Last updated on: 2026-04-15

Assigner: GitHub, Inc.

Description
mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-07
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-08
EPSS Evaluated
2026-06-15
NVD
CVE-2026-35533
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jdx mise From 2026.2.18 (inc) to 2026.4.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects mise, a tool that manages development tools like node, python, cmake, and terraform. Between versions 2026.2.18 and 2026.4.5, mise loads trust-control settings from a local project file named .mise.toml before performing a trust check. An attacker who can place a malicious .mise.toml file in a repository can cause mise to treat that file as trusted. This allows the attacker to execute dangerous directives such as environment source commands, templates, hooks, or tasks.

Impact Analysis

If exploited, this vulnerability can allow an attacker to execute arbitrary and potentially harmful commands or scripts within the development environment by leveraging the trusted .mise.toml file. This can lead to compromise of the development process, unauthorized code execution, and potentially full system compromise depending on the directives used.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35533. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart