In what appears to be originating from the usage project, for example how mise's bash completion is implemented, the mechanism enables overwriting arbitrary files that the invoking user has write access to using a symlink attack. This is due to use of predictable filenames in a (typically) world writable directory. Specifically, for example with` mise 2026.7.7: ```shellsession $ mise completion bash | sed -n 12,14p local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_7_7.spec" if [[ ! -f "$spec_file" ]]; then mise usage >| "$spec_file" ``` `"${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_7_7.spec"` could be a symlink pointing anywhere, planted by anyone/thing as this is very likely a world writable directory, resulting in the symlink target's contents replaced by the `mise usage` output. Exploitation does require quite accurate timing due to the `! -f` test, but that test does not eliminate the issue, it just makes it a TOCTOU one. `-f` returns true for symlinks pointing to regular files. Additionally, the use of `>|` as opposed to just `>` means users can not protect against this using the `noclobber` `set` option. I understand the reason for this appears to be to try and avoid `mise usage` calls, but considering on a not-that-fast-system-by-todays-standards ```shellsession $ time mise usage >/dev/null real 0m0,061s user 0m0,029s sys 0m0,037s ``` ... I think this is not a good security tradeoff, especially considering this is likely to happen at most once per shell session. I have not researched it further, but perhaps the use of temporary files could be removed altogether, and `usage` made to read the spec from stdin instead, always invoking `mise usage`? I have not checked the corresponding implementation for any other shells than bash. I also did not find any particular instructions for filing security related issues, therefore reporting like this.