CVE-2026-122133: Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
Event History
Frequently Asked Questions
Which systems and users are exposed?
The issue affects Mistral Vibe installations on Windows before version 2.25.5. A user is exposed when they open a crafted repository whose root contains a malicious git.exe.
Does the user need to approve a trust prompt before exploitation?
No. SessionLogger and ProjectContextProvider can run the repository-root git.exe at session start, before any trust prompt is displayed.
What does an attacker need to do to exploit this?
The attacker needs to place a malicious git.exe in the root of a repository and persuade a Windows user running an affected version to open that repository.
What should be done if an update cannot be applied immediately?
Avoid opening untrusted repositories, particularly repositories that contain a git.exe file in their root directory. The supplied data identifies version 2.25.5 as the fixed version.