Threats tagged 'ghsa-g74g-rg72-j2p3'

CVE-2026-103929 is an OS command injection vulnerability in the jdx mise tool. It arises because certain shell interpreter argument settings in local untrusted .mise.toml files are not properly restricted by the global_only denylist, allowing attackers to control the shell interpreter arguments used for command execution. This enables arbitrary command execution when a user runs trusted or global tasks without explicit shell settings. The vulnerability affects versions prior to 2026.7.14 and has a CVSS score of 7.8 (high severity).