CVE-2026-103929: mise permits untrusted local configuration to override default shell arguments

October 15, 2026

Untrusted local .mise.toml [settings] can set the shell interpreter args (unix/windows default_inline / default_file shell_args), yielding arbitrary command execution, because those command-interpreter settings were not added to the global_only denylist the CVE-2026-55448 fix relies on. Code execution from an untrusted repository with no trust prompt for the malicious file, on par with the patched CVE. Confirmed at HEAD 7160170206782fdd3ef287c8302369e32152fb71.

References

github.com/advisories/GHSA-g74g-rg72-j2p3
github.com/jdx/mise/commit/c6cd7a9a2ca580918562566126646e5d04317895
github.com/jdx/mise/pull/11293
github.com/jdx/mise/releases/tag/v2026.7.14
github.com/jdx/mise/security/advisories/GHSA-g74g-rg72-j2p3
nvd.nist.gov/vuln/detail/CVE-2026-103929

Code Behaviors & Features

Detect and mitigate CVE-2026-103929 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →