# mise (crates.io) vulnerabilities

6 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2026.11.4 (Nov 7, 2026): no advisory affects it
- Newest unaffected release: 2026.11.4 (Nov 7, 2026), the latest release
- Weekly downloads: 591
- Dependents: 0
- Releases: 500+ since 2024.9.5 (Sep 17, 2024)
- Registry: https://crates.io/crates/mise
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-103929: 2024.9.5 to 2026.7.13 (2026.7.14 is outside it)
- CVE-2026-33646: 2024.9.5 to 2026.3.9 (2026.3.10 is outside it)
- CVE-2026-55441: 2024.9.5 to 2026.6.3 (2026.6.4 is outside it)
- CVE-2026-54557: 2024.9.5 to 2026.6.0 (2026.6.1 is outside it)
- CVE-2026-55448: 2026.3.15 to 2026.6.3 (2026.6.4 is outside it)
- CVE-2026-35533: 2026.2.18 to 2026.6.3 (2026.6.4 is outside it)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (6)

### [CVE-2026-103929](https://cve.now/CVE-2026-103929): mise permits untrusted local configuration to override default shell arguments

- Severity: High 7.8
- Published: Oct 14, 2026
- Affected: fixed in 2026.7.14.
- Fixed in 2026.7.14 (released Jul 26, 2026, 80 days before disclosure).
- The latest release, 2026.11.4, is not affected.

### [CVE-2026-33646](https://cve.now/CVE-2026-33646): mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

- Severity: Critical 9.6
- Published: Jun 26, 2026
- Affected: fixed in 2026.3.10.
- Fixed in 2026.3.10 (released Mar 21, 2026, 97 days before disclosure).
- The latest release, 2026.11.4, is not affected.

### [CVE-2026-55441](https://cve.now/CVE-2026-55441): mise: Arbitrary command execution via task-include files in an untrusted, config-less repository

- Severity: High 8.6
- Published: Jun 26, 2026
- Affected: fixed in 2026.6.4.
- Fixed in 2026.6.4 (released Jun 12, 2026, 14 days before disclosure).
- The latest release, 2026.11.4, is not affected.

### [CVE-2026-54557](https://cve.now/CVE-2026-54557): mise HTTP backend uses raw version path for install symlink destination

- Severity: Medium 5.5
- Published: Jun 26, 2026
- Affected: fixed in 2026.6.1.
- Fixed in 2026.6.1 (released Jun 6, 2026, 20 days before disclosure).
- The latest release, 2026.11.4, is not affected.

### [CVE-2026-55448](https://cve.now/CVE-2026-55448): mise: Local credential\_command executes untrusted config

- Severity: Medium 6.3
- Published: Jun 26, 2026
- Affected: from 2026.3.15, fixed in 2026.6.4.
- Fixed in 2026.6.4 (released Jun 12, 2026, 14 days before disclosure).
- The latest release, 2026.11.4, is not affected.

### [CVE-2026-35533](https://cve.now/CVE-2026-35533): mise has a local settings bypass config trust checks

- Severity: High 7.8
- Published: Apr 7, 2026
- Affected: from 2026.2.18, fixed in 2026.6.4.
- Fixed in 2026.6.4 (released Jun 12, 2026, 66 days after disclosure).
- The latest release, 2026.11.4, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/mise
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.