AIKIDO-2026-291796

TL;DR

history.describe_command runs an arbitrary shell command whenever the bootstrap history watcher saves a checkpoint, passing the command JSON that includes a unified diff of the user's tracked dotfiles. Unlike the credential-command settings hardened for an earlier finding, history.describe_command is not marked global_only in settings.toml, so a project-local .mise.toml can set it. Routine commands such as mise install, mise exec, mise run, and mise watch implicitly trust the project directory with no explicit mise trust step or trust prompt, so the malicious command then runs and can exfiltrate credentials found in the tracked dotfiles. The fix marks history.describe_command global_only so local configs can no longer set it.