CVE-2026-71477: mise: Incorrect file ownership, when installed by the root user using `install.sh`
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISEINSTALLPATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miseto a version that resolves this vulnerability.Fixed in 2026.7.1 - Compensating control
If you cannot upgrade immediately, avoid installing mise as root using a shared MISE_INSTALL_PATH (e.g., do not target /usr/local/bin); use a non-shared directory with restricted write permissions so other users cannot replace root-installed executables.
Event History
Frequently Asked Questions
Which installations are realistically exposed?
Systems are exposed when root installs a vulnerable mise release using install.sh and the installation path is shared or writable in a way that lets the local account with UID/GID 1001 replace the executable. An installation under a shared path such as /usr/local/bin is specifically highlighted as higher risk.
What access does an attacker need to exploit this?
An attacker needs local access and must be able to act as the user or group identified by ID 1001. Exploitation also depends on a root-installed vulnerable executable whose ownership was preserved from the release archive.
How can I determine whether an existing installation is affected?
Upgrade mise to version 2026.7.1, which fixes the issue. For already-installed copies, check the ownership of the mise executable, particularly if it was installed by root with install.sh into a shared location; ownership by UID or GID 1001 indicates the described condition.