CVE-2026-122135: Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute the attacker's program at session start, before any trust prompt.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistral Vibeto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Mistral Vibe versions before 3.0.3 are exposed when they start a session involving a repository controlled or configured by an attacker. The command execution occurs during project context collection.
What must an attacker place in a repository to trigger execution?
The repository must configure gpg.program and log.showSignature, and contain a signed commit. These conditions cause git log to invoke the attacker-specified program.
Does the user need to approve a trust prompt before exploitation?
No. The vulnerable behavior occurs at session start before any trust prompt is shown.
What version addresses the issue?
Upgrade Mistral Vibe to version 3.0.3 or later. Versions before 3.0.3 are affected.