AI-written code allowed the `github.credential_command` setting from untrusted local `mise.toml` to run arbitrary shell commands via `sh -c`, leading to remote code execution.

+    CredentialCommand,     GitCredential, } @@ -315,6 +316,7 @@ impl fmt::Display for TokenSource {             TokenSource::EnvVar(name) => write!(f, "{name}"),             TokenSource::TokensFile => write!(f, "github_tokens.toml"),             TokenSource::GhCli => write!(f, "gh CLI (hosts.yml)"),+            TokenSource::CredentialCommand => write!(f, "credential_command"),             TokenSource::GitCredential => write!(f, "git credential fill"),         }     }@@ -337,7 +339,7 @@ fn canonical_host(host: Option<&str>) -> Option<&str> { /// 2. `MISE_GITHUB_TOKEN` / `GITHUB_API_TOKEN` / `GITHUB_TOKEN` env vars /// 3. `github_tokens.toml` (per-host) /// 4. gh CLI token (from `hosts.yml`)-/// 5. `git credential fill` (if enabled)+/// 5. `credential_command` (if set) OR `git credential fill` (if enabled) pub fn resolve_token(host: &str) -> Option<(String, TokenSource)> {     let settings = Settings::get(); @@ -381,8 +383,14 @@ pub fn resolve_token(host: &str) -> Option<(String, TokenSource)> {         return Some((token.clone(), TokenSource::GhCli));     } -    // 5. git credential fill-    if settings.github.use_git_credentials+    // 5. credential_command OR git credential fill+    let credential_command = &settings.github.credential_command;+    if !credential_command.is_empty() {+        if let Some(token) = get_credential_command_token(credential_command, lookup_host) {+            return Some((token, TokenSource::CredentialCommand));+        }+        debug!("credential_command returned no token; git credential fill will not be tried");+    } else if settings.github.use_git_credentials         && let Some(token) = get_git_credential_token(lookup_host)     {         return Some((token, TokenSource::GitCredential));@@ -535,6 +543,59 @@ struct GhHostEntry {     oauth_token: Option<String>, } +// ── credential_command ──────────────────────────────────────────────

+    let result = std::process::Command::new("sh")+        .arg("-c")

+        .output()+        .ok()+        .and_then(|output| {+            if !output.status.success() {+                if let Ok(err) = String::from_utf8(output.stderr)+                    && !err.trim().is_empty()+                {+                    debug!("credential_command stderr: {}", err.trim());+                }+                return None;+            }+            String::from_utf8(output.stdout)+                .ok()+                .map(|s| s.trim().to_string())+                .filter(|s| !s.is_empty())+        });+    trace!(+        "credential_command for {host}: {}",+        if result.is_some() {

+[github.credential_command]+default = ""+description = "Shell command to run to obtain a GitHub token for mise."+docs = """+When set, mise executes this command via `sh -c` and reads the token+from stdout. The hostname is passed as `$1`, making the command+host-aware for GitHub Enterprise environments. This replaces the+`git credential fill` fallback and does not require+`github.use_git_credentials` to be enabled.++The command should print a single token to stdout. Trailing whitespace+is trimmed. Results are cached per host per session.

 default = true description = "Read GitHub tokens from the gh CLI's hosts.yml config."

+            },             "gh_cli_tokens": {               "default": true,               "description": "Read GitHub tokens from the gh CLI's hosts.yml config.",

+    pub global_only: bool,

+fn strip_local_only_settings(settings: &mut toml::Table, path: &Path, is_global: bool) {+    if is_global {

+        if let Some(value) = remove_nested_toml_value(settings, key)+            && should_warn_ignored_global_only_value(&value)+        {+            warn!(+                "{key} in non-global config {} is ignored for security reasons",+                path.display()+            );+        }+    }+}++fn remove_nested_toml_value(table: &mut toml::Table, key: &str) -> Option<toml::Value> {+    let mut parts = key.split('.').collect_vec();+    let last = parts.pop()?;+    let mut current = table;+    for part in parts {+        current = current.get_mut(part)?.as_table_mut()?;+    }+    current.remove(last)+}++fn should_warn_ignored_global_only_value(value: &toml::Value) -> bool {+    !matches!(value, toml::Value::String(s) if s.is_empty())+}+ impl Settings {     pub fn parse_default_package_line(package: &str) -> Option<String> {

@@ -986,6 +1025,79 @@ where mod tests {     use super::*; +    fn credential_command_settings_table() -> toml::Table {+        toml::from_str::<toml::Value>(+            r#"+            [github]+            credential_command = "echo github-token"++            [gitlab]+            credential_command = "echo gitlab-token"++            [forgejo]+            credential_command = "echo forgejo-token"+            "#,+        )+        .unwrap()+        .as_table()+        .unwrap()

+        lines.push(format!(+            "        global_only: {},",+            props+                .get("global_only")+                .is_some_and(|v| v.as_bool().unwrap())+        ));     };     for (name, props) in &settings {         let props = props.as_table().unwrap();

@@ -757,6 +758,7 @@ is trimmed. Example: `op read "op://Private/GitHub Token/credential"` """ env = "MISE_GITHUB_CREDENTIAL_COMMAND"+global_only = true type = "String"  [github.gh_cli_tokens]@@ -920,6 +922,7 @@ is trimmed. Example: `op read "op://Private/GitLab Token/credential"` """ env = "MISE_GITLAB_CREDENTIAL_COMMAND"+global_only = true type = "String"  [gitlab.glab_cli_tokens]