GHSA-fjj5-v948-whjj: Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

Summary Mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This means an attacker can place a malicious .tool-versions file in a git repository, and when a victim with mise activated cds into the directory, arbitrary commands execute without any trust prompt. Vulnerability Details Vulnerable Code File: src/config/config_file/tool_versions.rs, lines 60-63 pub fn parse_str(s: &str, path: PathBuf) -> Result<Self> { let mut cf = Self::init(&path); let dir = path.parent(); let s = get_tera(dir).render_str(s, &cf.context)?; // <-- No trust check // ... } File: src/tera.rs, lines 385-391 pub fn get_tera(dir: Option<&Path>) -> Tera { let mut tera = TERA.clone(); let dir = dir.map(PathBuf::from); tera.register_function("exec", tera_exec(dir.clone(), env::PRISTINE_ENV.clone())); tera.register_function("read_file", tera_read_file(dir)); tera } File: src/tera.rs, lines 394-452 -- tera_exec passes the command argument to a shell for execution with no restrictions. File: src/config/config_file/mod.rs, lines 272-287 pub async fn parse(path: &Path) -> Result<Arc<dyn ConfigFile>> { if let Ok(settings) = Settings::try_get() && settings.paranoid { trust_check(path)?; // Only in paranoid mode! } match detect_config_file_type(path).await { // ... Some(ConfigFileType::ToolVersions) => Ok(Arc::new(ToolVersions::from_file(path)?)), // ... } } Attack Vector 1. An attacker creates a .tool-versions file in a git repository containing Tera template syntax with the exec() function. 2. The victim clones the repository and has mise activated in their shell (via eval "$(mise activate zsh)" or equivalent). 3. When the victim cds into the repository directory, mise's shell hook (hook-env) fires automatically. 4. hook-env loads and parses config files, including .tool-versions.