mise CVE-2026-71477

Three specific conditions must all hold simultaneously: (1) a local user account on the target system must have exactly UID 1001 and GID 1001 - the numeric identifiers embedded in the mise release tarball from the build environment; (2) a user with root privileges must run the mise standalone installer targeting a shared system path (MISE_INSTALL_PATH set to /usr/local/bin or similar), which is UI:R in CVSS terms; and (3) no explicit chown normalization was performed after installation (pre-2026.7.1 behavior). Exploitation is blocked when MISE_INSTALL_PATH targets a directory owned by a specific non-root user, when the system has no account with UID/GID 1001, when UID/GID namespace remapping is in effect, or when the installed binary is subsequently chowned to root. The requirement for local access with a specific UID eliminates remote and unauthenticated attack paths entirely.

CVSS 6.7 Medium is consistent with the constrained but realistic attack path. AV:L confirms local system access is required, AC:H reflects the specific UID/GID 1001 precondition, PR:L reflects the need for a valid local account, and UI:R reflects that root must actively run the installer. Despite C:H/I:H/A:H impact, real-world exploitation depends on a convergence of circumstances: a multi-user system where an untrusted account coincidentally shares UID 1001 with the build environment, combined with a root-initiated mise install or reinstall to a shared path. No EPSS score was provided in the input data and there is no KEV listing, indicating this is not known to be actively exploited. The attack is not remotely triggerable and cannot be automated without prior local foothold. Risk is elevated in shared hosting, development servers, or CI environments where UID 1001 is commonly assigned to a non-root service or developer account.

An attacker with a local shell account assigned UID/GID 1001 on a multi-user Linux server monitors or waits for a system administrator to install or update mise system-wide to /usr/local/bin. After the installer extracts the tarball and moves the binary - but before or after, since the preserved UID 1001 ownership persists - the attacker has write access to the mise binary and replaces it with a setuid shell dropper or reverse shell payload. The next invocation of mise by any user, including root via a cron job or CI pipeline, executes the attacker-controlled binary with the caller's privileges.