Read the docs
TI-2026-63252 Aliases CVE-2026-93993GHSA-92v2-hh9v-6vj5

Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

Priority HIGH 72CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Fixed mistral-vibe (mistralai): 2.25.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mistralaimistral-vibebefore 2.25.52.25.5Patch availableCNA
  • mistral-vibe Vendormistralai Affected before 2.25.5 Fixed in 2.25.5 Patch available CNA

Remediation

  • Fix · CNA mistral-vibe (mistralai) Fixed in 2.25.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93993
  2. 2026-10-03 Alias added: GHSA-92v2-hh9v-6vj5

References

Patch 1

Other 4

  • TI-2026-81009 Remote code execution in Mistral Vibe via Git filter drivers CVSS 4.0HIGH 8.7
  • TI-2026-60017 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60016 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60015 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60018 Incorrect permission assignment in mistralai mistral-vibe CVSS 4.0CRITICAL 10.0
  • TI-2026-60014 Path traversal in mistralai mistral-vibe CVSS 4.0CRITICAL 9.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences