jdx/mise · critical · eyre::Report

native cargo binary path must stay inside the artifact: {}

Error message

native cargo binary path must stay inside the artifact: {}

What it means

validate_native_bin_relative_path() is a path-traversal guard: the resolved binary path inside a binstall artifact must consist only of normal components. Any `..` (ParentDir), leading `/` (RootDir), or Windows drive prefix means the copy source would escape the extraction directory, so mise refuses it.

Source

Thrown at src/backend/cargo/native_binstall.rs:1029

        if extract_dir.join(&candidate).is_dir() {
            return format!("{candidate}/{{ bin }}{{ binary-ext }}");
        }
    }
    "{ bin }{ binary-ext }".to_string()
}

fn validate_native_bin_relative_path(path: &str) -> Result<PathBuf> {
    let path = PathBuf::from(path);
    if path.components().next().is_none() {
        bail!("native cargo binary path is empty");
    }
    if path.components().any(|component| {
        matches!(
            component,
            Component::ParentDir | Component::Prefix(_) | Component::RootDir
        )
    }) {
        bail!(
            "native cargo binary path must stay inside the artifact: {}",
            path.display()
        );
    }
    Ok(path)
}

fn validate_native_bin_sources(pending: &[(PathBuf, PathBuf)]) -> Result<()> {
    let mut sources = BTreeSet::new();
    for (src, _) in pending {
        if !sources.insert(src) {
            bail!(
                "native cargo binary artifact maps multiple bins to {}",
                file::display_path(src)
            );
        }
    }
    Ok(())

View on GitHub (pinned to 6f52dcdf99)

Solutions

1. Do not install the crate; if it came from an untrusted source, audit the crate's binstall metadata for traversal attempts
2. Remove custom bin-dir template overrides containing absolute paths or `..` from your own mise config
3. Install from source via `cargo install` which does not use artifact paths

# reject bin-dir templates containing traversal or absolute segments
[[ "$BIN_DIR" =~ \.\. ]] || [[ "$BIN_DIR" == /* ]] && echo 'unsafe template' || echo ok

When it happens

Trigger: A binstall bin-dir template or artifact layout resolves to a path like `../evil`, `/usr/bin/tool`, or `C:\tools\tool.exe` — i.e. anything escaping the extracted archive — during native binstall installation.

Common situations: Malicious or compromised crate metadata trying to point the installer at files outside the artifact (CVE-style supply-chain attempt); benign cases where a template accidentally includes an absolute path or `..` segment.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• content-level SLSA verification rejected unsafe archive path
• [dotfiles]."{}": target is not a safe OCI path
• brew-cask: invalid {kind} '{value}'
• brew-cask: staged symlink path escaped extraction root: {}
• brew-cask: refusing generic artifact source outside the extr

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/eefd55471e59f78f. Report an issue: GitHub.