{"id":"EUVD-2026-39814","enisaUuid":"af42a420-e8bf-3d47-b562-8b7181b6d40a","description":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend\u0027s symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.","datePublished":"Jun 26, 2026, 4:47:29 PM","dateUpdated":"Jun 26, 2026, 5:58:21 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3\n","aliases":"CVE-2026-54557\nGHSA-f94h-j2qg-fxw3\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"8487c5b4-1ad5-31ca-91a5-660a876d8726","product":{"name":"mise","vendor":{"name":"jdx"}},"product_version":"\u003c 2026.6.1"}],"enisaIdVendor":[{"id":"9c182f86-04c4-37df-a567-80f01d8e7822","vendor":{"name":"jdx"}}],"enisaIdVulnerability":[{"id":"26f91ac2-313e-3e83-bc03-38091c7330a6","vulnerability":{"id":"GHSA-f94h-j2qg-fxw3","description":"mise HTTP backend uses raw version path for install symlink destination","datePublished":"Jun 23, 2026, 6:13:53 PM","dateUpdated":"Jul 21, 2026, 3:04:34 PM","baseScore":0.0,"references":"https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54557\nhttps://github.com/jdx/mise\n","enisa_id":"EUVD-2026-39814\n","aliases":"CVE-2026-54557\nGHSA-f94h-j2qg-fxw3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"295b1640-5d21-34f7-9a8c-08dca5005391","vulnerability":{"id":"CVE-2026-54557","description":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend\u0027s symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.","datePublished":"Jun 26, 2026, 4:47:29 PM","dateUpdated":"Jun 26, 2026, 5:58:21 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3\n","enisa_id":"EUVD-2026-39814\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"5383e8d3-9a82-339d-9b84-10823df06897","product":{"name":"mise","vendor":{"name":"jdx"}},"product_version":"\u003c 2026.6.1"}],"vulnerabilityVendor":[{"id":"a0bba525-34d2-3b8c-ae31-4347b8526450","vendor":{"name":"jdx"}}]}}],"enisaIdAdvisory":[]}