CVE-2026-71477
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.7
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.10%
- CWE
- CWE-278
- Published
- 2026-08-18
- Last modified
- 2026-08-18
Affected products
- jdx mise
Weakness type
Related vulnerabilities
- CVE-2026-6265 — Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2
- CVE-2025-2947 — IBM i privilege escalation
- CVE-2024-38531 — Nix sandbox escape
- CVE-2023-38497 — Cargo not respecting umask when extracting crate archives