CVE-2026-71477mediumCWE-278

CVE-2026-71477: falha de média gravidade em jdx mise

mise: Incorrect file ownership, when installed by the root user using `install.sh`

Publicada em

Seguir esta CVE+ Monitorar mise

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.7epss 0.1%
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
jdx · mise
CVEs relacionadas — jdx mise

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33646CRITICALmise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)EPSS 0.5%CVE-2026-103929HIGHmise permits untrusted local configuration to override default shell argumentsEPSS 0.3%CVE-2026-55448MEDIUMmise: Local credential_command executes untrusted configEPSS 0.2%CVE-2026-55441HIGHmise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryEPSS 0.2%CVE-2026-54557MEDIUMmise HTTP backend uses raw version path for install symlink destinationEPSS 0.2%CVE-2026-35533HIGHmise has a local settings bypass config trust checksEPSS 0.2%