{"id":"EUVD-2026-39813","enisaUuid":"0b5eb8c1-da16-32aa-a38b-cafefd7a6ea0","description":"mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set. This vulnerability is fixed in 2026.6.4.","datePublished":"Jun 26, 2026, 4:46:17 PM","dateUpdated":"Jun 27, 2026, 2:47:55 AM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph\n","aliases":"CVE-2026-55448\nGHSA-29hf-rm4x-xxph\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"5f154ccb-655f-33ab-9bb6-50f4bb4ca05b","product":{"name":"mise","vendor":{"name":"jdx"}},"product_version":"\u003c 2026.6.4"}],"enisaIdVendor":[{"id":"4e49d732-4d03-38c5-98f6-4cc244999d5d","vendor":{"name":"jdx"}}],"enisaIdVulnerability":[{"id":"90b1a994-925b-3d92-a615-5ad64556823b","vulnerability":{"id":"GHSA-29hf-rm4x-xxph","description":"Mise\u0027s local credential_command executes untrusted config","datePublished":"Jun 23, 2026, 6:24:28 PM","dateUpdated":"Jun 23, 2026, 6:24:28 PM","baseScore":0.0,"references":"https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph\nhttps://github.com/jdx/mise\n","enisa_id":"EUVD-2026-39813\n","aliases":"GHSA-29hf-rm4x-xxph\nCVE-2026-55448\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f0a7cd20-5015-3272-b03e-d25a165f1490","vulnerability":{"id":"CVE-2026-55448","description":"mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set. This vulnerability is fixed in 2026.6.4.","datePublished":"Jun 26, 2026, 4:46:17 PM","dateUpdated":"Jun 27, 2026, 2:47:55 AM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph\n","enisa_id":"EUVD-2026-39813\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 3, 2026, 7:16:19 AM","vulnerabilityProduct":[{"id":"3bdad71e-eb0a-3e55-979e-7c370b0ddeef","product":{"name":"mise","vendor":{"name":"jdx"}},"product_version":"\u003c 2026.6.4"}],"vulnerabilityVendor":[{"id":"e86e3595-31dc-3ab0-a60a-9242c2dc1340","vendor":{"name":"jdx"}}]}}],"enisaIdAdvisory":[]}