Skip to content
Threat Feed
Subscribe

Tag

Mise

2 briefs RSS
critical advisory

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

A critical vulnerability (CVE-2026-33646) in Mise allows for arbitrary code execution on victim machines via malicious `.tool-versions` files containing Tera template syntax, which are processed without trust verification, enabling silent supply chain attacks upon directory entry.

mise rce supply-chain trust-bypass code-execution developer-tools cve
1r 5t 1c
high advisory

Mise Trust Bypass Vulnerability via Malicious .mise.toml

A vulnerability in mise allows an attacker who can place a malicious .mise.toml file in a repository to bypass trust checks and execute arbitrary code via `[env] _.source` due to improper loading of trust settings.

mise trust-bypass code-execution vulnerability
2r 2t