mise CVE-2026-103929

Requires: (1) mise running in its default non-safe mode; (2) the victim executing mise inside an untrusted local project whose .mise.toml [settings] sets unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, or windows_default_inline_shell_args; and (3) a trusted task that has NO explicit shell - or a postinstall directive, template exec operation, or hook that falls back to the default shell. LIMITING FACTORS: exploitation is local (attacker must get the victim to use a malicious repo) and needs user interaction (the developer must run the affected task); tasks that specify an explicit shell are not affected, and versions 2026.7.14+ strip these settings from local configs so only global config can set them.

This is a legitimate but conditional local-escalation risk rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) correctly reflects that exploitation is local and requires user interaction: a developer must run mise inside an attacker-supplied repository. No EPSS score was provided in the input, and there is no CISA KEV listing and no standalone public exploit, so the exploitation status is 'no public exploit identified at time of analysis' - the only code evidence is the vendor fix PR (#11293) and its regression tests, which demonstrate the mechanism but are not a weaponized exploit. The signals are internally consistent: local vector + required user interaction + no KEV/EPSS data all point to a supply-chain/social-engineering style issue (malicious repo) rather than remote automatable compromise. PR:N is accurate because the attacker needs no account on the victim host - they only need to get the victim to clone and operate on a hostile project. Net: worth prioritizing for developer workstations and CI that auto-run mise on untrusted code, but it is not a drop-everything internet-facing emergency; absence of EPSS/KEV data should be noted, not treated as 'low risk confirmed.'

A developer clones or opens an attacker-controlled repository containing a malicious .mise.toml that sets unix_default_inline_shell_args (or the file/windows equivalents) to a hostile interpreter plus arguments. In mise's default non-safe mode this local [settings] block is loaded before the project is trusted, so when the developer runs a trusted task that has no explicit shell (or a postinstall/template-exec/hook that falls back to the default shell), mise invokes the attacker's interpreter arguments first and the attacker-chosen command executes with the developer's privileges. No public exploit is published, though the fix PR includes tests illustrating the flaw.