Read the docs
TI-2026-85176 Aliases CVE-2026-122135GHSA-qx7j-gch3-gv7c

Mistral Vibe RCE via repository-configured gpg.program

Priority LOW 38CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

Mistral Vibe before 3.0.3 contains a remote code execution flaw in project context collection. A crafted repository sets gpg.program and log.showSignature, and when a signed commit exists, git log runs the attacker's program at session start, before any trust prompt. The weakness is classified as CWE-829. CVSS 4.0 base score is 8.6 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute the attacker's program at session start, before any trust prompt.

Why it matters now

EPSS 0.00469 40th percentileScored 2026-11-07
Fix Fixed mistral-vibe (mistralai): 3.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mistralaimistral-vibebefore 3.0.33.0.3Patch availableCNA
  • mistral-vibe Vendormistralai Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA

Remediation

Upgrade mistral-vibe to version 3.0.3 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA mistral-vibe (mistralai) Fixed in 3.0.3

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122135
  2. 2026-11-04 Alias added: GHSA-qx7j-gch3-gv7c
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 1

Other 4

  • TI-2026-81009 Remote code execution in Mistral Vibe via Git filter drivers CVSS 4.0HIGH 8.7
  • TI-2026-63252 Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout CVSS 4.0HIGH 8.6
  • TI-2026-60017 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60016 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60015 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CVSS 4.0CRITICAL 10.0
  • TI-2026-60018 Incorrect permission assignment in mistralai mistral-vibe CVSS 4.0CRITICAL 10.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences