CVE-2026-116843 in Mistral Vibe
Summary
by MITRE • 10/27/2026
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Mistral Vibe prior to version 3.0.3 represents a critical remote code execution flaw rooted in the improper handling of Git configuration files within untrusted repositories. This issue specifically targets the interaction between Git's filter driver mechanisms and the application's worktree management features. When an attacker controls or influences the contents of an untrusted repository, they can craft a malicious .git/config file that defines custom git filter drivers. These filters are designed to process content during checkout operations, allowing for arbitrary command execution through smudge, clean, or process hooks defined in the configuration.
The core technical flaw occurs when Mistral Vibe initiates a worktree operation using the --worktree flag and subsequently executes the git worktree add command. During this process, the application applies .gitattributes files from the repository being added to the new working tree. Crucially, before performing any security checks related to trusted folders or safe directories, Git processes these attributes by invoking the configured filter commands. This sequence of operations means that if a malicious .git/config is present in the source repository, the associated smudge, clean, or process filters are executed immediately upon checkout initiation. Because this execution happens prior to the validation against trusted-folder restrictions, the attacker's payload runs with the privileges of the user launching Mistral Vibe, effectively bypassing intended security boundaries.
From an operational impact perspective, this vulnerability allows for arbitrary code execution on the victim's system under their current user context. This can lead to full system compromise if the user has elevated permissions or access to sensitive data within that environment. The attack vector is particularly dangerous because it leverages a common development workflow feature—adding worktrees—which may be used frequently and with less scrutiny than direct repository cloning. An attacker could distribute a malicious repository via email, shared drives, or other means, waiting for the victim to add its contents as a worktree within Mistral Vibe. Once triggered, the code execution is silent and immediate, potentially installing backdoors, exfiltrating data, or pivoting to further network attacks without user interaction beyond initiating the worktree addition.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), as it involves injecting malicious commands into a legitimate process through configuration files. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging system utilities like Git for execution. The failure to validate the trustworthiness of external repositories before executing their configured filters highlights a significant gap in input validation and security context management within the application's workflow handling logic.
To mitigate this risk, users must upgrade Mistral Vibe to version 3.0.3 or later immediately upon release, as these versions address the ordering issue by ensuring that trusted-folder checks are performed before any filter drivers are invoked during worktree operations. In environments where upgrading is not instantly feasible, administrators should enforce strict policies regarding which repositories can be added as worktrees within Mistral Vibe. This includes restricting access to untrusted or external repositories and auditing existing configurations for suspicious git filter definitions. Additionally, running the application with least-privilege principles can limit the impact of any successful exploitation by reducing the permissions available to the executed commands. Security teams should also monitor for unusual process creation events involving Git filters during worktree operations as an indicator of potential compromise attempts.