Mise patches high-severity shell injection flaw CVE-2026-103929 in version 2026.7.14
A new high-severity vulnerability in the mise tool allows arbitrary command execution via untrusted configuration files. Version 2026.7.14 fixes the issue.
Key points
- CVE-2026-103929 allows arbitrary command execution through untrusted local mise.toml files.
- The flaw stems from missing global_only tags on four shell interpreter argument settings.
- Version 2026.7.14 patches the vulnerability; earlier versions up to 2026.7.13 remain affected.
The mise development tool has released version 2026.7.14 to address a high-severity security flaw identified as CVE-2026-103929. This update resolves an issue where untrusted configuration files could trigger arbitrary command execution without user consent.
What happened
The vulnerability exists because four shell interpreter argument settings were not included in the global_only denylist. This denylist was established to remediate previous flaws CVE-2026-55448 and CVE-2026-35533. Those earlier fixes aimed to prevent local project settings from being harvested by the settings preloader independent of the trust store. The maintainers correctly marked three forge credential_command values as global_only. However, they omitted the four shell-interpreter-args settings from this protection list.
The affected settings are unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args. These fields determine the interpreter used for every command mise spawns. Because they lack the global_only tag, the strip logic in src/config/settings.rs fails to remove them from non-global configurations. Consequently, an untrusted repository can set these arguments via a local .mise.toml file.
Why it matters
This flaw enables arbitrary command execution on systems running vulnerable versions of mise. The execution occurs without a trust prompt for the malicious file. This behavior is on par with the severity of the previously patched CVE-2026-55448. The settings preloader loads every config path, including local project files. Since the strip logic only removes keys marked global_only, any field without this tag survives from an untrusted local config.
What to watch
- Monitor for updates to the global_only denylist in future releases.
- Review local .mise.toml files for unexpected shell argument modifications.
- Check system logs for unauthorized command execution events.
- Verify that all mise installations are updated to version 2026.7.14.
Who needs to act first
Teams should prioritize updating mise on systems that process untrusted repositories. Start by identifying environments where developers clone external code frequently. Test the update in a non-production environment first to ensure compatibility with existing workflows. Back up current configuration files before applying the patch. If immediate updating is not possible, restrict access to untrusted repositories. Ensure that only trusted sources can execute commands on shared development machines.
What to do and how to stay safe: mise
- Update mise to version 2026.7.14 or later on all affected systems.
- Audit local .mise.toml files for unexpected shell interpreter arguments.
- Restrict execution of mise commands from untrusted repositories until patched.
- Monitor system logs for signs of arbitrary command execution attempts.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of mise are affected by CVE-2026-103929?
Versions up to and including 2026.7.13 are vulnerable. Version 2026.7.14 contains the fix.
Does this vulnerability require user interaction to exploit?
No, the flaw allows command execution without a trust prompt for the malicious file.
What specific settings caused this vulnerability?
Four shell-interpreter-args settings were missing the global_only tag in the denylist.
