CVE-2026-71477mediumCWE-278

CVE-2026-71477: fallo de gravedad media en jdx mise

mise: Incorrect file ownership, when installed by the root user using `install.sh`

Publicada el

Seguir esta CVE+ Monitorear mise

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.7epss 0.1%
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
jdx · mise
CVEs relacionadas — jdx mise

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-33646CRITICALmise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)EPSS 0.5%CVE-2026-103929HIGHmise permits untrusted local configuration to override default shell argumentsEPSS 0.3%CVE-2026-55448MEDIUMmise: Local credential_command executes untrusted configEPSS 0.2%CVE-2026-55441HIGHmise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryEPSS 0.2%CVE-2026-54557MEDIUMmise HTTP backend uses raw version path for install symlink destinationEPSS 0.2%CVE-2026-35533HIGHmise has a local settings bypass config trust checksEPSS 0.2%