The jdx mise tool manages developer tools installations and prior to version 2026.6.1, its HTTP backend constructs symlink destinations using the raw resolved version string for non-latest versions. On Unix-like systems, if this version string is an absolute path, the path joining logic discards the intended root directory, enabling a path traversal attack. An attacker controlling the .tool-versions file can cause mise to create symlinks outside the installation tree, including placing executable symlinks under arbitrary absolute paths that may be included in the PATH environment variable. This vulnerability is addressed in mise version 2026.6.1.

This vulnerability allows an attacker with control over the .tool-versions file to create symbolic links outside the intended installation directory, potentially placing executable symlinks in attacker-chosen locations. This can lead to unauthorized modification of the filesystem structure and influence over executable paths, which may result in execution of attacker-controlled binaries. The CVSS score of 5.5 (medium) reflects limited attack vector (local) and required user interaction, with no confidentiality or availability impact but high integrity impact.

A fix is available in mise version 2026.6.1. Users should upgrade to this version or later to remediate the vulnerability. No other vendor advisories or temporary mitigations are provided. Until upgrading, avoid using untrusted .tool-versions files to prevent exploitation.