PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35533 Jdx CVE debrief

CVE-2026-35533 is a high-severity vulnerability in Mise, a tool for managing development tools like Node, Python, CMake, and Terraform. From version 2026.2.18 through 2026.4.5, Mise loads trust-control settings from a local project .mise.toml before the trust check runs. This allows an attacker who can place a malicious .mise.toml in a repository to make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

Vendor
Jdx
Product
Mise
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Developers and administrators using Mise for managing development tools should be aware of this vulnerability and take immediate action to mitigate the risk. This vulnerability has a high CVSS score of 7.7, indicating a significant threat to affected systems.

Technical summary

The vulnerability exists in Mise versions from 2026.2.18 through 2026.4.5. The tool loads trust-control settings from a local project .mise.toml file before performing the trust check. An attacker who can manipulate this file can make it appear trusted, allowing access to dangerous directives such as [env] _.source, templates, hooks, or tasks. This can lead to high-impact attacks, including code execution and unauthorized access. Developers and administrators should be aware of this vulnerability and take immediate action to mitigate the risk. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.

Defensive priority

High priority should be given to updating Mise to a version outside the vulnerable range (before 2026.2.18 or after 2026.4.5). Additionally, caution should be exercised when working with .mise.toml files from untrusted sources.

Recommended defensive actions

  • Update Mise to a version outside the vulnerable range.
  • Exercise caution when working with .mise.toml files from untrusted sources.
  • Monitor for and restrict suspicious .mise.toml files in repositories.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-04-07T21:17:17.870Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability is categorized under CWE-284 (Improper Access Control) as a secondary weakness and NVD-CWE-noinfo as the primary weakness.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T21:17:17.870Z and has not been modified since then. The NVD entry is currently Analyzed.