CVE-2026-103929

Name of the Vulnerable Software and Affected Versions mise versions prior to 2026.7.14

Description In the default non-safe mode, the software loads settings from a .mise.toml file in an untrusted local project before trust approval. Because the strip local only settings function only removes fields marked as global only, certain settings were not properly filtered. Specifically, the unix default file shell args, unix default inline shell args, windows default file shell args, and windows default inline shell args variables could be manipulated by a malicious repository. This allows an attacker to replace default interpreter arguments used by trusted tasks without an explicit shell, postinstall directives, template exec operations, or hooks. Consequently, an attacker-controlled command can execute with the privileges of the developer account, even if the local configuration was not trusted.

Recommendations Update to version 2026.7.14.