CyberRota Analysis
AI-GeneratedThe vulnerability affects the mise management tool, specifically in versions prior to 2026.7.1, where release tar archives improperly handle user and group IDs, allowing local users with ID 1001 to replace root-installed executables in shared locations like /usr/local/bin. This could lead to privilege escalation and potential system compromise. Organizations utilizing mise for development tools should prioritize upgrading to version 2026.7.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.