Nixpkgs security tracker

Permalink CVE-2026-71477

6.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

mise: Incorrect file ownership, when installed by the root user using `install.sh`

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1.

References

https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp x_refsource_CONFIRMexploit
https://github.com/jdx/mise/pull/10808 x_refsource_MISC
https://github.com/jdx/mise/pull/10819 x_refsource_MISC
https://github.com/jdx/mise/commit/b65dd674d75d9aa5c038b58a3a0cdb522cf258d5 x_refsource_MISC
https://github.com/jdx/mise/commit/f1c28906f17af74430ff96f4438733c4a842c88d x_refsource_MISC
https://github.com/jdx/mise/releases/tag/v2026.7.1 x_refsource_MISC

Affected products

mise

==< 2026.7.1

Matching in nixpkgs

pkgs.mise

Front-end to your dev env

nixos-unstable 2026.6.11
- nixpkgs-unstable 2026.6.13
- nixos-unstable-small 2026.8.3
nixos-26.05 2026.5.12
- nixos-26.05-small 2026.5.12
- nixpkgs-26.05-darwin 2026.5.12

pkgs.haskellPackages.promises

Lazy demand-driven promises

nixos-unstable 0.3
- nixpkgs-unstable 0.3
- nixos-unstable-small 0.3
nixos-26.05 0.3
- nixos-26.05-small 0.3
- nixpkgs-26.05-darwin 0.3

pkgs.python313Packages.promise

Ultra-performant Promise implementation in Python

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.python314Packages.promise

Ultra-performant Promise implementation in Python

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.ocamlPackages.promise_jsoo

Js_of_ocaml bindings to JS Promises with supplemental functions

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-26.05 0.3.1
- nixos-26.05-small 0.3.1
- nixpkgs-26.05-darwin 0.3.1

pkgs.python313Packages.heatmiserv3

Library to interact with Heatmiser Themostats using V3 protocol

nixos-unstable 2.0.6
- nixpkgs-unstable 2.0.6
- nixos-unstable-small 2.0.6
nixos-26.05 2.0.6
- nixos-26.05-small 2.0.6
- nixpkgs-26.05-darwin 2.0.6

pkgs.python314Packages.heatmiserv3