CVE-2026-103929: mise Package Vulnerability Allows Untrusted Local Configuration to Override Shell Arguments
Summary
CVE-2026-103929: mise permits untrusted local configuration to override default shell arguments. Affects mise versions < 2026.7.14. Fixed in 2026.7.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mise package is a tool designed for managing and executing tasks in a development environment. It allows users to define configurations and commands in a structured manner. However, it has been found to have a critical vulnerability that permits untrusted local configurations to manipulate default shell arguments, potentially leading to arbitrary command execution.
Vulnerability Detail
The vulnerability arises from the mishandling of local configuration files (.mise.toml) that can set shell interpreter arguments without proper validation. This flaw allows an attacker to execute arbitrary commands by crafting malicious shell arguments in an untrusted repository. The issue was identified due to the absence of certain command-execution fields in the global_only denylist, which is meant to prevent untrusted settings from overriding safe defaults. As a result, when a user runs tasks or commands that rely on these settings, they may inadvertently execute malicious payloads.
How To Fix
Latest published version: 2026.10.17 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.7.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually inspect and validate any .mise.toml files in their project directories to ensure that no untrusted configurations are present. Additionally, avoid running commands in directories containing untrusted repositories until the package is updated.
Conclusion
The CVE-2026-103929 vulnerability in the mise package poses a significant risk by allowing untrusted configurations to manipulate shell arguments, leading to potential arbitrary command execution. Users are strongly advised to update to the patched version and implement the recommended workarounds until they can do so.
See every vulnerability recorded for mise →
FAQ
CVE-2026-103929 is a vulnerability in the mise package that allows untrusted local configurations to override default shell arguments, potentially leading to arbitrary command execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, manually inspect .mise.toml files for untrusted configurations and avoid executing commands in directories with untrusted repositories.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
More information about the mise package can be found on its official repository on crates.io or GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for mise.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
