CVE-2026-93993: Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running Mistral Vibe versions before 2.25.5 are exposed when they create a worktree from an attacker-supplied repository. The crafted hook runs with the privileges of the user running Vibe.
What does an attacker need to exploit this issue?
An attacker needs to provide a repository containing a crafted git post-checkout hook and induce a user to use it with Vibe. No attacker privileges are required, but user interaction is required.
Are default trust protections sufficient to prevent exploitation?
No. The vulnerable worktree-creation process executes git hooks before trust validation, so trust validation occurs too late to prevent the crafted post-checkout hook from running.
What version resolves the vulnerability?
Upgrade Mistral Vibe to version 2.25.5 or later. Versions before 2.25.5 are affected.