Mise Arbitrary Code Execution via Tera Templates in .tool-versions Files

Vulnerability Overview Vulnerability Name Arbitrary Code Execution via Tera Templates in Files (Trust Bypass) Vulnerability Description Mise parses files using the Tera template engine and registers the function, allowing arbitrary command execution. Unlike files, files are not subject to trust verification when the paranoid mode is disabled. This means an attacker can place a malicious file in a directory within a Git repository. When a victim activates that directory using mise, arbitrary commands will be executed without any trust prompts. Affected Versions Affected versions: < 2026.3.10 Fixed version: 2026.3.10 Severity CVSS v3 Base Score: 9.6 / 10 Vulnerability Details Vulnerable Code Attack Vector 1. An attacker creates a file containing Tera template syntax and the function within a Git repository. 2. The victim clones the repository and activates mise in their shell (e.g., via or an equivalent command). 3. When the victim s into the repository directory, mise's shell hook ( ) is automatically triggered. 4. loads and parses configuration files, including . 5. During parsing, processes the file content via . 6. The Tera engine evaluates , executing arbitrary commands as the victim user. 7. Since is not called in non-paranoid mode, no trust prompt is displayed. Execution Context Commands are executed with the current user's identity, having full access to their environment. The passed environment ( ) contains all user environment variables (excluding tokens, credentials, SSH agents, etc., depending on configuration). Execution occurs silently during the prompt hook—with no indication to the user that code has run. Comparison with files are protected: calls before parsing anything (see line 213 in ). During , untrusted files cannot be parsed and return an error, preventing any code execution. files lack this protection. Reproduction Steps Prerequisites mise installed (e.g., ) Shell activation enabled (e.g., or for / ) Default settings (paranoid mode is disabled by default) PoC: Silent RCE on Step 1: Create a directory simulating a cloned repository containing a malicious Step 2: In a new shell where mise is activated, enter the directory Step 3: Verify arbitrary code execution Expected Output Verification of Test Results Tested on: 2026-03-16 mise 2026.3 macos-arm64 macOS Darwin 24.5.0-arm64 zsh 5.9 paranoid mode: false (default) Test 1: (No Trust Check) Test 2: with Same Payload (Trust Check Prevents Execution) Alternative PoC (Data Exfiltration) Impact Arbitrary Code Execution: Occurs on any machine where mise is activated and the user enters a directory containing a malicious file. Supply Chain Attack Vector: is a widely used convention, typically committed to repositories. Developers expect it to contain only tool names and versions, not executable content. Silent Execution: Occurs without trust prompts, warnings, or user interaction. Full User Privilege Escalation: Commands run with full user privileges and environment access. Credential Theft: The user's full environment (including tokens, API keys, SSH agents, etc.) is available for command execution. Widespread Potential Impact: Any open-source project can be targeted. A malicious PR adding Tera syntax can execute code on all reviewers' machines. Recommended Fixes Option 1: Add to Parsing (Recommended) Option 2: Remove from Tera Context Create a separate that does not register the function, and use it during parsing. Option 3: Completely Remove Tera Processing from is an asdf-compatible format that historically does not support templates. Removing Tera from the parsing logic would be the safest approach and most consistent with user expectations.

Goal Reached Thanks to every supporter — we hit 100%!

Mise Arbitrary Code Execution via Tera Templates in .tool-versions Files

More from this source