CVE-2026-122134: Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers
Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistral Vibeto a version that resolves this vulnerability.Fixed in 2.25.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Mistral Vibe versions before 2.25.7 are exposed if they open a repository crafted with malicious Git clean or process filter-driver configuration. The commands run with the affected user's privileges.
What does an attacker need to exploit it?
An attacker needs to persuade a user to open a crafted repository. No authentication or elevated privileges are required, but user interaction is required to open the repository.
Does the user have an opportunity to approve or trust the repository before code runs?
No. Mistral Vibe runs git status during startup through ProjectContextProvider._fetch_git_status, which can invoke the malicious filters before any trust prompt appears.
What version addresses the issue?
Version 2.25.7 addresses the issue. Versions before 2.25.7 are affected according to the provided information.