Description

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-18T16:18:16.290Z",
  "pubdate": "2026-08-18T16:18:16.290Z",
  "executiveSummary": "An insecure file extraction vulnerability exists in mise prior to version 2026.7.1, where release tar archives record the binary mise/bin/mise with hardcoded user and group IDs of 1001.\nThe packaging/standalone/install.envsubst script extracts and relocates this binary without normalizing ownership permissions.\nThis flaw allows a local user matching the hardcoded UID/GID 1001 to replace a root-installed executable, specifically when MISE_INSTALL_PATH is configured to target a shared system location such as /usr/local/bin.\nThe risk implication involves local privilege escalation or arbitrary code execution under the privileges of another user or root executing the shared binary.\nExploitation requires a local attacker with the specific UID/GID 1001 to manipulate or anticipate the extraction process into a shared installation path.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of file ownership during the extraction and installation of standalone release tar archives.\nDuring the packaging phase, release tar archives record the internal file path mise/bin/mise with explicit user and group identifiers set to 1001.\nThe installation script, packaging/standalone/install.envsubst, extracts the archive contents and moves the binary to its destination without performing ownership normalization or stripping the embedded UID and GID metadata.\nWhen an administrator or user sets MISE_INSTALL_PATH to a shared system-wide directory such as /usr/local/bin and executes the installation script, the resulting binary retains the ownership attributes assigned inside the archive.\nIf a local attacker on the host system possesses user ID and group ID 1001, they gain write access or ownership over the extracted executable file due to the unmitigated UID/GID mapping.\nThe attack flow proceeds as follows: first, the attacker ensures they operate under UID/GID 1001 or awaits a shared installation targeting a common directory. Second, the victim or automated deployment script executes the vulnerable packaging/standalone/install.envsubst installation mechanism, deploying mise to a shared path like /usr/local/bin. Third, because ownership is not normalized to the executing user (such as root), the file retains UID/GID 1001. Fourth, the attacker overwrites the mise binary at the shared path with a malicious payload.\nUpon subsequent execution of the compromised mise binary by privileged users or automated systems, the malicious payload executes with the privileges of the executing user, leading to potential local privilege escalation.\nThe vulnerable component is the standalone installation script packaging/standalone/install.envsubst and the associated release tar archive generation process affecting mise prior to version 2026.7.1.\nNo network exposure is required as the attack vector is strictly local, depending on local user IDs and shared filesystem paths."
}