CVE-2026-93993

Received Received - Intake

Remote Code Execution in Mistral Vibe Before 2.25.5

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93993

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Mistral Vibe before 2.25.5 has a remote code execution flaw where git hooks are executed before trust validation during worktree creation. Attackers can craft a malicious post-checkout hook in a repository to run arbitrary shell commands with the user's privileges.

Detection Guidance

Check Mistral Vibe version with 'vibe --version'. If version is below 2.25.5, the system is vulnerable. Inspect git repositories for unexpected post-checkout hooks in .git/hooks directory.

Impact Analysis

If you use Mistral Vibe before 2.25.5, an attacker could trick you into cloning a malicious repository, triggering the hook to execute harmful commands on your system with your user permissions.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data integrity and confidentiality requirements in GDPR or HIPAA. Unauthorized access or data exfiltration may result in compliance breaches.

Mitigation Strategies

Upgrade Mistral Vibe to version 2.25.5 or later. Review and remove any untrusted git hooks in repositories. Avoid using Vibe with untrusted repositories until patched.

Hi! I’m here to help you understand CVE-2026-93993. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70