CVE-2026-122133

Received Received - Intake

Mistral Vibe Untrusted Search Path Vulnerability on Windows

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-122133

EUVD

EUVD-2026-117087

Affected Vendors & Products

Vendor	Product	Version / Range
mistralai	mistral-vibe	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

Mistral Vibe before version 2.25.5 on Windows has an untrusted search path vulnerability. Attackers can place a malicious git.exe file in a repository root. When users open the crafted repository, SessionLogger and ProjectContextProvider may execute the malicious git.exe during session initialization before any trust prompt appears, enabling remote code execution.

Detection Guidance

Check Mistral Vibe version with 'mistral-vibe --version'. If version is below 2.25.5 on Windows, the system is vulnerable. Inspect repository roots for unexpected git.exe files. Monitor for unauthorized session starts or title changes in SessionLogger logs.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with high privileges. If you open a malicious repository, the attacker's code could run before you see any security prompts, potentially compromising your system or data.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR and HIPAA. It may result in unauthorized access to sensitive data, requiring breach notifications and compliance investigations.

Mitigation Strategies

Upgrade Mistral Vibe to version 2.25.5 or later immediately. Remove any untrusted git.exe files from repository roots. Review and restrict write permissions in project directories. Monitor for suspicious activity in session logs.

Hi! I’m here to help you understand CVE-2026-122133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...