CVE-2026-103929: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in jdx mise

The vulnerability in jdx mise involves improper neutralization of special elements used in OS commands (CWE-78). In default non-safe mode, mise loads .mise.toml settings from untrusted local projects before trust approval. Certain shell argument settings (unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, windows_default_inline_shell_args) were not marked as global_only, allowing an attacker to control interpreter arguments. When mise appends trusted commands after these attacker-controlled arguments, the injected commands execute first with developer account privileges. This flaw affects versions prior to 2026.7.14 and is resolved in that version.

An attacker controlling a local project repository can execute arbitrary commands with the privileges of the developer account by injecting malicious interpreter arguments. This leads to high impact on confidentiality, integrity, and availability of the affected system. The vulnerability enables command injection despite the local configuration not being trusted, due to improper marking of certain settings.

Upgrade to jdx mise version 2026.7.14 or later, where this vulnerability is fixed by properly marking the relevant shell argument settings as global_only. No other mitigations are specified. Patch status is confirmed fixed in 2026.7.14.