CVE-2026-71477

Published: Ago 18, 2026 Last Modified: Ago 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,7
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.

278

Insecure Preserved Inherited Permissions

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/jdx/mise/security/advisories/GHSA-9mm4-f…
https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp
https://github.com/jdx/mise/commit/b65dd674d75d9aa5c038b58a…
https://github.com/jdx/mise/commit/b65dd674d75d9aa5c038b58a3a0cdb522cf258d5
https://github.com/jdx/mise/commit/f1c28906f17af74430ff96f4…
https://github.com/jdx/mise/commit/f1c28906f17af74430ff96f4438733c4a842c88d
https://github.com/jdx/mise/pull/10808
https://github.com/jdx/mise/pull/10808
https://github.com/jdx/mise/pull/10819
https://github.com/jdx/mise/pull/10819
https://github.com/jdx/mise/releases/tag/v2026.7.1
https://github.com/jdx/mise/releases/tag/v2026.7.1
https://github.com/jdx/mise/security/advisories/GHSA-9mm4-f…
https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp