Nixpkgs security tracker

Dismissed

Permalink CVE-2026-33646

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

Created suggestion 1 month ago
@LeSuisse dismissed 1 month ago

mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This means an attacker can place a malicious .tool-versions file in a git repository, and when a victim with mise activated cds into the directory, arbitrary commands execute without any trust prompt. This vulnerability is fixed in 2026.3.10.

References

https://github.com/jdx/mise/security/advisories/GHSA-fjj5-v948-whjj x_refsource_CONFIRM

Affected products

mise

==< 2026.3.10

Matching in nixpkgs

pkgs.mise

Front-end to your dev env

nixos-unstable 2026.6.0
- nixpkgs-unstable 2026.6.0
- nixos-unstable-small 2026.6.0
nixos-26.05 2026.5.12
- nixos-26.05-small 2026.5.12
- nixpkgs-26.05-darwin 2026.5.12

pkgs.haskellPackages.promises

Lazy demand-driven promises

nixos-unstable 0.3
- nixpkgs-unstable 0.3
- nixos-unstable-small 0.3
nixos-26.05 0.3
- nixos-26.05-small 0.3
- nixpkgs-26.05-darwin 0.3

pkgs.python312Packages.promise

None

pkgs.python313Packages.promise

Ultra-performant Promise implementation in Python

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.python314Packages.promise

Ultra-performant Promise implementation in Python

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.ocamlPackages.promise_jsoo

Js_of_ocaml bindings to JS Promises with supplemental functions

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-26.05 0.3.1
- nixos-26.05-small 0.3.1
- nixpkgs-26.05-darwin 0.3.1

pkgs.python312Packages.heatmiserv3

None

pkgs.python313Packages.heatmiserv3

Library to interact with Heatmiser Themostats using V3 protocol

nixos-unstable 2.0.6
- nixpkgs-unstable 2.0.6
- nixos-unstable-small 2.0.6
nixos-26.05 2.0.6
- nixos-26.05-small 2.0.6
- nixpkgs-26.05-darwin 2.0.6

pkgs.python314Packages.heatmiserv3