{"record":{"id":"7e2f70e6bb271b12","repo":"jdx/mise","slug":"paranoid-mode-is-enabled-refusing-to-install-comm","errorCode":null,"errorMessage":"Paranoid mode is enabled, refusing to install community-developed plugin","messagePattern":"Paranoid mode is enabled, refusing to install community-developed plugin","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/plugins/asdf_plugin.rs","lineNumber":288,"sourceCode":"        mpr: &MultiProgressReport,\n        force: bool,\n        dry_run: bool,\n    ) -> Result<()> {\n        let settings = Settings::try_get()?;\n        if !force {\n            if self.is_installed() {\n                return Ok(());\n            }\n            if !settings.yes && self.repo_url.lock().unwrap().is_none() {\n                let url = self.get_repo_url(config).unwrap_or_default();\n                if !registry::is_trusted_plugin(self.name(), &url) {\n                    warn!(\n                        \"⚠️ {} is a community-developed plugin – {}\",\n                        style(&self.name).blue(),\n                        style(url.trim_end_matches(\".git\")).yellow()\n                    );\n                    if settings.paranoid {\n                        bail!(\n                            \"Paranoid mode is enabled, refusing to install community-developed plugin\"\n                        );\n                    }\n                    if !prompt::confirm_with_all(format!(\n                        \"Would you like to install {}?\",\n                        self.name\n                    ))?\n                    .is_yes()\n                    {\n                        Err(PluginNotInstalled(self.name.clone()))?\n                    }\n                }\n            }\n        }\n        let prefix = format!(\"plugin:{}\", style(&self.name).blue().for_stderr());\n        let pr = mpr.add_with_options(&prefix, dry_run);\n        if !dry_run {\n            let _lock = lock_file::get(&self.plugin_path, force)?;","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/plugins/asdf_plugin.rs#L270-L306","documentation":"With `paranoid` settings enabled, mise refuses to install asdf plugins whose git URL is not on the official/trusted allowlist, because community plugins execute arbitrary code during install. The message is raised in ensure_installed before any code from the plugin runs.","triggerScenarios":"Installing a third-party asdf plugin (e.g. `mise plugin add <name> <community-git-url>`) while `paranoid = true` (MISE_PARANOID=1) is set; also triggered for tools requested by a project config that reference community plugins.","commonSituations":"Security-conscious CI environments with paranoid mode on; new machines where a project .mise.toml references a community plugin; orgs with allowlists that haven't been extended.","solutions":["Audit the plugin repository, then either disable paranoid mode (`MISE_PARANOID=0` or `mise settings paranoid=false`) or pre-approve the plugin per your org policy.","Use an official/core backend for the tool instead of a community asdf plugin.","If this is on a shared/CI machine, install the plugin once interactively outside paranoid mode and let mise reuse the installed plugin."],"exampleFix":"// before (in config, with paranoid=true)\nmise plugin add nightly-crystal https://github.com/someone/asdf-crystal.git\n// after\nMISE_PARANOID=0 mise plugin add nightly-crystal https://github.com/someone/asdf-crystal.git  # after auditing the repo","handlingStrategy":"validation","validationCode":"// before installing in CI, fail fast if paranoid mode blocks community plugins\nconst paranoid = process.env.MISE_PARANOID === '1';\nconst isOfficial = trustedPluginUrls.includes(pluginUrl);\nif (paranoid && !isOfficial) throw new Error('paranoid mode blocks community plugin ' + pluginUrl);","typeGuard":null,"tryCatchPattern":"try {\n  execSync(`mise plugin add ${name} ${url}`);\n} catch (e) {\n  if (/Paranoid mode is enabled/.test(String(e.stderr))) {\n    // switch to an official backend or run an audited allowlisted install step\n  }\n}","preventionTips":["Audit community plugin repos before adding them; document the audit for your org.","Prefer mise core tools or aqua/github backends which don't execute arbitrary plugin code.","Keep MISE_PARANOID=1 in CI and pre-install/allowlist plugins during image build."],"tags":["security","asdf","plugin","paranoid"],"backgroundTag":"permission-denied","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}