Read the docs
TI-2026-85175 Aliases CVE-2026-122134GHSA-3fw5-5q64-5hwx

Code execution in Mistral Vibe via malicious Git filter drivers

Priority LOW 38CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

Mistral Vibe before 2.25.7 allows remote code execution through malicious Git clean or process filter drivers configured in a repository (CWE-829). When a user opens a crafted repository, Mistral Vibe runs git status at startup, which invokes the filters and executes commands with the user's privileges before any trust prompt. The attacker needs only that the user opens the repository.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.

Why it matters now

EPSS 0.00469 40th percentileScored 2026-11-07
Fix Fixed mistral-vibe (mistralai): 2.25.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mistralaimistral-vibebefore 2.25.72.25.7Patch availableCNA
  • mistral-vibe Vendormistralai Affected before 2.25.7 Fixed in 2.25.7 Patch available CNA

Remediation

Upgrade Mistral Vibe to version 2.25.7, the fixed version for mistralai mistral-vibe.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA mistral-vibe (mistralai) Fixed in 2.25.7

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122134
  2. 2026-11-04 Alias added: GHSA-3fw5-5q64-5hwx
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2026-81009 Remote code execution in Mistral Vibe via Git filter drivers CVSS 4.0HIGH 8.7
  • TI-2026-63252 Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout CVSS 4.0HIGH 8.6
  • TI-2026-60017 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60016 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60015 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60018 Incorrect permission assignment in mistralai mistral-vibe CVSS 4.0CRITICAL 10.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences