Mise
Monthly
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.