CVE-2026-71477mediumCWE-278

CVE-2026-71477: medium-severity vulnerability in jdx mise

mise: Incorrect file ownership, when installed by the root user using `install.sh`

Published

Follow this CVE+ Monitor mise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.7epss 0.1%
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
jdx · mise
Related CVEs — jdx mise

In the same product, most dangerous first.

CVE-2026-33646CRITICALmise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)EPSS 0.5%CVE-2026-103929HIGHmise permits untrusted local configuration to override default shell argumentsEPSS 0.3%CVE-2026-55448MEDIUMmise: Local credential_command executes untrusted configEPSS 0.2%CVE-2026-55441HIGHmise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryEPSS 0.2%CVE-2026-54557MEDIUMmise HTTP backend uses raw version path for install symlink destinationEPSS 0.2%CVE-2026-35533HIGHmise has a local settings bypass config trust checksEPSS 0.2%