Skip to content

Incorrect file ownership, when `mise` is installed by the root user using `install.sh`

Moderate
jdx published GHSA-9mm4-fgvc-x7rp Jul 7, 2026

Package

cargo mise (Rust)

Affected versions

<2026.7.1

Patched versions

2026.7.1

Description

Summary

When mise is installed by the root user, using install.sh provided by mise,
the uid and gid of the installed mise executable, is uid=1001 and gid=1001

Details

  • all .tar.* files in the mise releases, embedded the files with the owner of uid=1001 and uid=1001, instead of uid=0 and gid=0
  • install.sh of the mise project, does not call tar with --no-same-owner

PoC

  1. Run the following command by the root user
  2. Download install.sh, for example https://github.com/jdx/mise/releases/download/v2026.7.0/install.sh
  3. Run ./install.sh as root
  4. Check the ownership of /root/.local/bin/mise, such as using the command stat /root/.local/bin/mise

Impact

This causes root installed mise,
is vulnerable to be modified by a uid=1001 user,
causing a Local Privilege Escalation issue.

This only affects mise installation using install.sh.

This issue has more impact, when
using install.sh with the environment variable MISE_INSTALL_PATH,
to install to a system shared location, such as /usr/local/bin

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE ID

CVE-2026-71477

Weaknesses

Insecure Preserved Inherited Permissions

A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement. Learn more on MITRE.

Credits