CVE-2026-109429

A flaw was found in mistral-vibe. This vulnerability allows an attacker to bypass command permission security checks, leading to arbitrary command execution. By embedding command substitutions inside variables that are evaluated using Bash prompt-transform operators, malicious commands can evade...

CVE-2026-122135

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122134

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

CVE-2026-122133

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

CVE-2026-122135 Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122134

Mistral Vibe versions before 2.25.7 are vulnerable to remote code execution due to the way the application handles Git repositories. The vulnerability exists because the ProjectContextProvider._fetch_git_status function executes git status at startup, which can trigger malicious Git clean or proc...

CVE-2026-122135

Mistral Vibe versions before 3.0.3 are vulnerable to Remote Code Execution (RCE) during project context collection. The root cause is the abuse of repository-configured gpg.program settings; a crafted repository containing a specific gpg.program and log.showSignature setting, combined with a sign...

EUVD-2026-117088

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

EUVD-2026-117089

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122134 Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

CVE-2026-122133

Mistral Vibe versions before 2.25.5 on Windows are vulnerable to an untrusted search path vulnerability (CWE-427). An attacker can achieve Remote Code Execution (RCE) by placing a malicious git.exe in a repository root and luring a user into opening that repository. The application's SessionLogge...

EUVD-2026-117087

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

CVE-2026-122133 Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

CVE-2026-122133 Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

PT-2026-137157

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 3.0.3 Description Remote code execution is possible during project context collection when the application runs git at startup. An attacker can abuse repository-configured settings, specifically the gpg.program a...

PT-2026-137155

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

PT-2026-137156

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider. fetch git status runs git status at startup...

SUSE CVE-2026-116843

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

CVE-2026-116843

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

CVE-2026-116843 Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...