Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository
Date: 2026-06
Affected: rust/mise
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-55441
CWE: CWE-732
CWE-78
CWE-94
CVSS: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

### Summary mise's trust feature gates config files (`mise.toml`, `.tool-versions`) through `trust_check`, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (`mise-tasks/`, `.mise/tasks/`, …) but no config file, mise falls back to the default includes and renders each task's tera fields — and that tera environment has `exec()` registered. A `{{ exec(command='…') }}` in any rendered field runs arbitrary commands the moment the tasks are merely listed. There's no config file to gate on, so no trust prompt ever appears. Read-only commands trigger it: `mise tasks`, `mise task ls`, `mise run`, `mise tasks --usage` (the query shell completion runs on Tab). The victim only has to `cd` into a cloned repo and list or tab-complete a task ## Details Trust is enforced only inside config-file parsing: - `src/config/config_file/mise_toml.rs:276` — `MiseToml::from_str` → `trust_check(path)?` - `src/config/config_file/tool_versions.rs:62` — `.tool-versions` parser → `trust_check(&path)?` - `src/config/env_directive/mod.rs:681` — env templates → `trust_check(path)?` (only when the value contains template syntax) Task-include files are loaded by `load_tasks_in_dir` / `load_local_tasks_with_context`, which walk every directory from CWD up to root. For each directory, `configs_at_root` returns the parsed (trusted) configs rooted there; **if there is no config in the directory**, mise falls back to the default task-include list resolved


Mitigations:

Architectural layers (MAESTRO):