CVE-2026-116843 Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

CVE-2026-116843

Versions of Mistral Vibe before 3.0.3 are vulnerable to remote code execution (RCE) . The flaw occurs when the software is started with the --worktree flag, causing git worktree add to apply .gitattributes and execute filter commands (smudge, clean, or process) from an untrusted repository's .git...

EUVD-2026-110574

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

CVE-2026-109429

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

CVE-2026-109428

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-109429

Mistral Vibe versions prior to 2.25.4 are vulnerable to a command permission gate bypass (CWE-436). The root cause is a logic flaw where tree-sitter-bash static parsing fails to detect command substitutions hidden inside single-quoted variable values. Attackers can exploit this by using the ${var...

CVE-2026-109429 Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

CVE-2026-109429 Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

CVE-2026-109428

Mistral Vibe versions before 2.25.5 are vulnerable to a permission validation bypass due to a parsing discrepancy between tree-sitter-bash and bash . The flaw exists in the _extract_commands() function of bash.py, where the system incorrectly handles backslash-newline line continuations . An atta...

CVE-2026-109428 Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-109428 Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-109428: Interpretation Conflict

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

PT-2026-111824

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...

CVE-2026-109429: Interpretation Conflict

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

mistral-vibe-2.25.8-1.1 on GA media (moderate)

mistral-vibe-2.25.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:11900-1 Rating: moderate Cross-References: CVE-2026-93993 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:11900-1 mistral-vibe-2.25.8-1.1 on GA media

These are all security issues fixed in the mistral-vibe-2.25.8-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-93993

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...

EUVD-2026-83621

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...

CVE-2026-93993

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...

CVE-2026-93993 Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...