AIKIDO-2026-268136

TL;DR

mise loads the [settings] table from a project-local .mise.toml before evaluating whether that config is trusted, and the default shell-interpreter argument settings (unix_default_inline_shell_args, unix_default_file_shell_args, and their Windows equivalents) are not restricted to global config. A local, untrusted config can therefore override the interpreter used to run inline commands, file tasks, postinstall directives, hooks, and exec template calls that originate from trusted or global sources. Because the real command is appended after the operator-controlled interpreter arguments, an untrusted repository can achieve arbitrary command execution when a developer runs a task, installs a tool, or renders a template while inside that directory. The fix marks the four default shell-argument settings as global-only so they are stripped from non-global configuration.