CVE-2026-35533: 
Rust vulnerability analysis and mitigation

CVE-2026-35533 is a trust bypass vulnerability in mise (a polyglot runtime manager written in Rust) that allows local code execution via a malicious .mise.toml configuration file. The flaw affects mise versions >= 2026.2.18 through <= 2026.4.5. It was published on April 3, 2026 by the project maintainer and added to the GitHub Advisory Database on April 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.7–7.8 (High), depending on the scoring source (GitHub Advisory, mise Security Advisory).

The root cause is improper access control (CWE-284) in the configuration loading order: Settings::try_get() preloads local project settings files — including trust-control directives — before trust_check() runs, meaning an untrusted .mise.toml can influence the trust evaluation that is supposed to gate it. The primary exploit path sets trusted_config_paths = ["/"] in the local [settings] block; since is_trusted() iterates over settings.trusted_config_paths() and checks if the canonicalized path starts with any listed prefix, every absolute path matches and the file is marked trusted before dangerous directives are evaluated. A secondary variant (introduced in v2026.2.18) allows yes = true or ci = true in a local config to auto-approve trust prompts. Both paths were confirmed on mise v2026.3.17 running on Docker linux-arm64 (GitHub Advisory, mise Security Advisory).

Successful exploitation allows an attacker with write access to a repository directory to achieve arbitrary code execution in the context of the user running mise. By placing a crafted .mise.toml, the attacker can trigger execution of attacker-controlled scripts via the [env] _.source directive, as well as templates, hooks, and tasks that mise would normally refuse to run from untrusted configs. This compromises confidentiality, integrity, and availability of the affected system, and could serve as a foothold for lateral movement in developer or CI/CD environments where mise is widely used (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a complete malicious .mise.toml and shell script payload with exact reproduction steps. The EPSS score is approximately 0.006% (0th percentile), and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to place a file in a repository directory that a victim user navigates into and runs mise commands (e.g., mise hook-env -s bash --force) (GitHub Advisory, mise Security Advisory).

1. Gain write access: Obtain write access to a repository directory that a target developer or CI system uses with mise — this could be via a malicious pull request, a compromised dependency, or direct filesystem access.
2. Create the malicious .mise.toml: Place the following content in the repository root as .mise.toml:

[settings]
trusted_config_paths = ["/"]

[env]
_.source = ["./poc.sh"]

3. Create the payload script: Place an attacker-controlled shell script poc.sh in the same directory:

#!/usr/bin/env bash
echo trusted_paths_hookenv > /tmp/mise-proof.txt
# Replace with actual malicious payload (e.g., reverse shell, credential theft)

4. Wait for victim interaction: When the target user navigates into the repository directory and mise runs (e.g., via shell hook or explicit mise hook-env -s bash --force), Settings::try_get() preloads the local .mise.toml including trusted_config_paths = ["/"].
5. Trust bypass triggers: is_trusted() evaluates the preloaded settings, finds that the project path starts with /, marks the config as trusted, and proceeds to evaluate the [env] _.source directive.
6. Arbitrary code execution: poc.sh is executed in the context of the victim user, achieving arbitrary code execution (GitHub Advisory, mise Security Advisory).

• File System: Presence of a .mise.toml in a repository directory containing trusted_config_paths = ["/"], yes = true, or ci = true under a [settings] block; unexpected shell scripts referenced by _.source directives in .mise.toml; creation of unexpected files (e.g., /tmp/mise-proof.txt) by mise-spawned processes.
• Process: Unexpected child processes spawned by mise (e.g., /bin/bash, sh, curl, wget) when running mise hook-env or similar commands; shell scripts executing from repository working directories.
• Logs: Shell history or audit logs showing mise hook-env -s bash --force executed in an unfamiliar or recently cloned repository directory; process audit logs (e.g., auditd) recording script execution originating from mise.
• Network: Outbound connections from developer workstations or CI runners to unexpected external hosts shortly after mise command execution, potentially indicating reverse shell or data exfiltration payloads (GitHub Advisory).

The fix requires that mise not honor trust-control settings (trusted_config_paths, yes, ci, paranoid) when they are loaded from non-global project config files — only global config should be permitted to set these values. As of the advisory publication, no patched version was listed (affected range: >= 2026.2.18, <= 2026.4.5); users should update to a version later than 2026.4.5 once available. In the interim, avoid cloning or working in repositories from untrusted sources, restrict write access to repository directories, and audit any .mise.toml files for suspicious [settings] directives before running mise commands (GitHub Advisory, mise Security Advisory).

The vulnerability was reported by security researcher kq5y and published by the mise maintainer (jdx) on April 3, 2026. Coverage has appeared on several CVE tracking and threat intelligence aggregation sites shortly after disclosure. No significant vendor statements beyond the original advisory or notable researcher commentary beyond the reporter have been identified at this time (GitHub Advisory).