CVE-2026-33646: Mise Arbitrary Code Execution via Tera Template Injection in .tool-versions

Vulnerability Overview

CVE-2026-33646 is a critical trust bypass vulnerability in mise (formerly rtx), the polyglot runtime version manager written in Rust. The root cause is improper sanitisation of .tool-versions files before they are passed to mise's Tera template engine. An attacker who can plant or modify a .tool-versions file — for example, inside a cloned repository or a shared project directory — can embed Tera template directives that are evaluated with the privileges of the developer or CI runner executing mise install, mise run, or any other command that reads the file. This results in arbitrary code execution without the victim receiving a trust prompt. The vulnerability carries a CVSS score of 9.6.

Affected Software

• Product: mise (formerly rtx)
• Vendor ecosystem: Rust / crates.io
• Affected versions: all releases prior to 2026.3.10

No patched release has been confirmed at the time of writing. Organisations should treat any mise installation below 2026.3.10 as actively vulnerable.

Exploitation Status

A public proof-of-concept exists. With PoC code already circulating, the barrier to exploitation is low — any threat actor with the ability to introduce a malicious .tool-versions file into a developer's workflow (via supply chain, open-source pull request, or social engineering) can achieve immediate code execution. CI/CD pipelines that automatically run mise against checked-out code are particularly high-risk targets. Defenders should treat this as actively weaponisable rather than theoretical.

How Our Detection Catches It

The df00tech detection library ships coverage for CVE-2026-33646 across seven SIEM platforms:

• Microsoft Sentinel (KQL)
• Splunk (SPL)
• Elastic (EQL)
• IBM QRadar (AQL)
• Sumo Logic
• Google Chronicle (YARA-L)
• CrowdStrike (CQL)

Detection logic focuses on two complementary signal layers. The first layer monitors process execution: child processes spawned by mise that are inconsistent with normal tool installation activity — shells, interpreters, or network utilities — are flagged as high-confidence indicators of template injection payload execution. The second layer targets filesystem telemetry: writes to or reads of .tool-versions files that contain Tera syntax markers ({{, {%) correlate against subsequent anomalous process trees. Both layers are tuned to minimise noise in polyglot developer environments where mise is legitimately in heavy use.

Get the Full Detection

The complete KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL queries — along with triage guidance and atomic test mappings — are available on the CVE-2026-33646 detection page. Free-tier users can access all SIEM queries; purple team playbooks and atomic tests are available to paid subscribers.