crates.ioPackage

mise

6 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 2026.11.4 (Nov 7, 2026): no advisory affects it
Newest unaffected release: 2026.11.4 (Nov 7, 2026), the latest release
Advisories: 6 · 1 critical, 3 high, 2 medium

Weekly downloads: 591
Dependents: 0
Releases: 500+ since 2024.9.5 (Sep 17, 2024)
Registry: crates.io
Releases read: Nov 8, 2026

Version timeline

CVE-2026-103929
Affects 2024.9.5 to 2026.7.13 (2026.7.14 is outside it)
CVE-2026-33646
Affects 2024.9.5 to 2026.3.9 (2026.3.10 is outside it)
CVE-2026-55441
Affects 2024.9.5 to 2026.6.3 (2026.6.4 is outside it)
CVE-2026-54557
Affects 2024.9.5 to 2026.6.0 (2026.6.1 is outside it)
CVE-2026-55448
Affects 2026.3.15 to 2026.6.3 (2026.6.4 is outside it)
CVE-2026-35533
Affects 2026.2.18 to 2026.6.3 (2026.6.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 6

CVE-2026-103929High 7.8
mise permits untrusted local configuration to override default shell arguments
Affected: fixed in 2026.7.14.
Fixed in 2026.7.14 (released Jul 26, 2026, 80 days before disclosure).
The latest release, 2026.11.4, is not affected.
CVE-2026-33646Critical 9.6
mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
Affected: fixed in 2026.3.10.
Fixed in 2026.3.10 (released Mar 21, 2026, 97 days before disclosure).
The latest release, 2026.11.4, is not affected.
CVE-2026-55441High 8.6
mise: Arbitrary command execution via task-include files in an untrusted, config-less repository
Affected: fixed in 2026.6.4.
Fixed in 2026.6.4 (released Jun 12, 2026, 14 days before disclosure).
The latest release, 2026.11.4, is not affected.
CVE-2026-54557Medium 5.5
mise HTTP backend uses raw version path for install symlink destination
Affected: fixed in 2026.6.1.
Fixed in 2026.6.1 (released Jun 6, 2026, 20 days before disclosure).
The latest release, 2026.11.4, is not affected.
CVE-2026-55448Medium 6.3
mise: Local credential_command executes untrusted config
Affected: from 2026.3.15, fixed in 2026.6.4.
Fixed in 2026.6.4 (released Jun 12, 2026, 14 days before disclosure).
The latest release, 2026.11.4, is not affected.
CVE-2026-35533High 7.8
mise has a local settings bypass config trust checks
Affected: from 2026.2.18, fixed in 2026.6.4.
Fixed in 2026.6.4 (released Jun 12, 2026, 66 days after disclosure).
The latest release, 2026.11.4, is not affected.