Nixpkgs security tracker
6.3 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
mise: Local credential_command executes untrusted config
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set. This vulnerability is fixed in 2026.6.4.
References
-
https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph x_refsource_CONFIRM
Affected products
- ==< 2026.6.4
Matching in nixpkgs
pkgs.mise
Front-end to your dev env
pkgs.haskellPackages.promises
Lazy demand-driven promises
pkgs.python312Packages.promise
None
pkgs.python313Packages.promise
Ultra-performant Promise implementation in Python
pkgs.python314Packages.promise
Ultra-performant Promise implementation in Python
pkgs.ocamlPackages.promise_jsoo
Js_of_ocaml bindings to JS Promises with supplemental functions
pkgs.python312Packages.heatmiserv3
None
pkgs.python313Packages.heatmiserv3
Library to interact with Heatmiser Themostats using V3 protocol
pkgs.python314Packages.heatmiserv3
Library to interact with Heatmiser Themostats using V3 protocol
pkgs.haskellPackages.unsafe-promises
Create pure futures using lazy IO
pkgs.ocamlPackages_latest.promise_jsoo
Js_of_ocaml bindings to JS Promises with supplemental functions