{"id":"EUVD-2026-39814","revision":"6b0e89ae7dae4e2580305f7d315531c2","records":[{"revision":"6b0e89ae7dae4e2580305f7d315531c2","observedAt":"2026-10-30T09:51:52.948+00:00","statement":{"source":"euvd","id":"EUVD-2026-39814","aliases":["CVE-2026-54557","GHSA-f94h-j2qg-fxw3"],"title":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the …","description":"mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlink path uses the raw value. On Unix-like systems, if that version is an absolute path, PathBuf::join discards the intended mise installs root. A repository-controlled .tool-versions file can therefore make mise install create a symlink outside the mise install tree. With bin_path, the same issue can place an executable symlink under an attacker-selected absolute prefix, such as a developer-tool prefix that is later added to PATH. This vulnerability is fixed in 2026.6.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.5,"severity":null}],"references":["https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39814","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 4:47:29 PM","dateUpdated":"Jun 26, 2026, 5:58:21 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39814","identifiers":["EUVD-2026-39814","CVE-2026-54557","GHSA-f94h-j2qg-fxw3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}