mise Symlink Path Traversal via Raw Version String

Executive Summary

The CVE-2026-54557 vulnerability in the mise HTTP backend occurs because it uses the raw version string to build symlink destinations instead of sanitized paths. This flaw allows an attacker to create symbolic links outside the intended installation directory by providing a specially crafted version string that can be an absolute path. On Unix-like systems, this causes the symlink to be created in arbitrary locations outside the mise install tree.

Specifically, a repository-controlled .tool-versions file can exploit this behavior to place symlinks in attacker-controlled directories. This can lead to placing executable symlinks under attacker-selected absolute prefixes, such as developer-tool prefixes that might later be added to the system PATH.

This vulnerability was fixed in mise version 2026.6.1 by ensuring that sanitized version paths are used for symlink creation, preventing symlinks from being created outside the designated installation directories.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the creation of symlinks outside the intended mise install directory due to improper handling of version paths in the HTTP backend. Detection would involve checking for unexpected or unauthorized symlinks created by mise, especially those located outside the normal installation directories.

You can inspect the filesystem for symlinks created by mise that point outside the expected install tree. For example, on Unix-like systems, you might use commands like:

• find /path/to/mise/install -type l -exec ls -l {} + | grep -v '/path/to/mise/install'
• find / -type l -user mise_user -exec ls -l {} + # if mise runs under a specific user
• Check the .tool-versions file in repositories for absolute paths that could trigger this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized creation of symbolic links outside the intended installation directory. This can lead to unauthorized file system modifications.

An attacker could place executable symlinks in directories that are later included in your system's PATH environment variable, potentially enabling execution of malicious code when those symlinks are invoked.

Overall, this can compromise system integrity and security by allowing code execution through manipulated symlinks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to create symlinks outside the intended installation directory, potentially leading to unauthorized file system modifications and execution of malicious code.

Such unauthorized access and potential code execution could lead to breaches of data integrity and security controls required by standards like GDPR and HIPAA, which mandate protection of sensitive data and system integrity.

Therefore, if exploited, this vulnerability could negatively impact compliance with these regulations by enabling unauthorized actions that compromise system security and data protection.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade mise to version 2026.6.1 or later, where the vulnerability has been fixed by sanitizing version paths used for symlink creation.

Until the upgrade can be applied, avoid using untrusted or repository-controlled .tool-versions files that specify absolute paths, as these can be exploited to create symlinks outside the intended directories.

Additionally, monitor and restrict permissions on directories where mise installs tools to prevent unauthorized symlink creation.

Useful 0 Not Useful 0