CVE-2026-71477
MediumCVSS 6.7Summary
The mise tool, managing developer tool versions, before version 2026.7.1 records mise/bin/mise with user and group ID 1001, and the installation process does not normalize ownership, allowing a local user with those IDs to replace the installed executable, especially when MISE_INSTALL_PATH targets a shared location like /usr/local/bin.
Risk Assessment
A local user with IDs 1001 can take control of the mise executable, potentially leading to privilege escalation or running malicious code in an administrator context.
Recommendation
Update mise to version 2026.7.1 or later, which includes a fix normalizing file ownership during installation.
Original NVD description (English source)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.