The vulnerability in jdx mise (versions 2026.2.18 to 2026.4.5) involves improper access control (CWE-284) where the software loads trust-control settings from a local project .mise.toml file before the trust verification process completes. This allows an attacker who can place a crafted .mise.toml file in a repository to have that file treated as trusted, potentially leading to execution of harmful directives including environment variable sources, templates, hooks, or tasks. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with local attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an attacker with local repository write access to bypass trust checks and execute dangerous directives within mise, potentially leading to full compromise of the development environment's confidentiality, integrity, and availability. This could result in unauthorized code execution, environment manipulation, and disruption of build or deployment processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to repositories to trusted users only and avoid using affected mise versions in untrusted environments. Monitor vendor channels for updates and apply patches promptly once released.