mise (formerly rtx-cli) before 2026.10.9: a `path:` tool version (e.g. `node path:./local`) in an untrusted project's .tool-versions or mise.toml is not subject to the config trust check, so `mise activate` prepends the project-controlled directory to PATH on `cd` without a trust prompt, letting a repository shadow commands such as git with its own binaries. Fixed in 2026.10.9 (commit 27e92ea0). rtx-cli 1.11.0 through 2024.0.0 carries the same code and has no fixed release.