Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because mise loads and executes a credential_command from a local .mise.toml configuration file without first verifying if the file is trusted. This allows an attacker who can create or modify a .mise.toml file in a repository to execute arbitrary shell commands on a victim's machine.
The execution flow starts when mise needs to resolve a GitHub token. The Settings::try_get() function loads all configuration files, including local, untrusted ones. The resolve_token() function in src/github.rs then checks for a credential_command in the settings. If found, it calls get_credential_command_token(), which proceeds to execute the command using sh -c.
The vulnerability is triggered when a user runs a mise command that requires GitHub authentication (e.g., mise github token) in a directory containing a malicious .mise.toml file, and no higher-priority GitHub token is set via environment variables.
The vulnerable functions are:
github::get_credential_command_token: This is the sink, where the command is executed.github::resolve_token: This function retrieves the malicious command from settings and calls the sink.config::settings::Settings::try_get and config::settings::parse_settings_file: These functions are responsible for loading the untrusted configuration.The fix, as suggested in the advisory, is to prevent credential_command from being loaded from non-global configuration files within the parse_settings_file function.
github::get_credential_command_tokensrc/github.rs
github::resolve_tokensrc/github.rs
config::settings::Settings::try_getsrc/config/settings.rs
config::settings::parse_settings_filesrc/config/settings.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mise | rust | >= 2026.3.15, < 2026.6.4 | 2026.6.4 |