CVE-2026-122134

Received Received - Intake

Remote Code Execution in Mistral Vibe

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-122134

EUVD

EUVD-2026-117088

Affected Vendors & Products

Vendor	Product	Version / Range
mistralai	mistral-vibe	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Mistral Vibe before version 2.25.7 has a remote code execution flaw. Attackers can exploit it by setting up malicious Git filter drivers in a repository. When a user opens the crafted repo, the app runs 'git status' at startup, triggering these filters to execute arbitrary commands with the user's privileges before any security prompt appears.

Detection Guidance

Check Mistral Vibe version with 'mistral-vibe --version'. If version is below 2.25.7, the system is vulnerable. Review Git repository configurations for suspicious filter drivers in .git/config or .gitattributes files.

Impact Analysis

This vulnerability allows attackers to run commands on your system with your user privileges. If you open a malicious repository, it could install malware, steal data, modify files, or take control of your development environment without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA. It may result in unauthorized access to sensitive data, requiring breach notifications and compliance investigations.

Mitigation Strategies

Update Mistral Vibe to version 2.25.7 or later immediately. Avoid opening untrusted repositories until updated. Review and remove any unknown Git filter drivers in repositories.

Hi! I’m here to help you understand CVE-2026-122134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...