{"id":"CVE-2026-54557","revision":"bc2b42e4def44fa0bc8c83e5e081105e","records":[{"revision":"bc2b42e4def44fa0bc8c83e5e081105e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54557","aliases":[],"title":"mise HTTP backend uses raw version path for install symlink destination","description":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.","state":0,"publishedAt":"2026-06-26T16:47:29.487+00:00","modifiedAt":"2026-06-26T17:58:21.233+00:00","affected":[{"ecosystem":"Vendor product","name":"mise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jdx\",\n                    \"product\": \"mise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2026.6.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54557","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54557","identifiers":["CVE-2026-54557"]},"retained":false,"historicalAffected":[]}],"coverage":[]}