CVE-2026-122134 in Mistral Vibe
Summary
by MITRE • 11/04/2026
Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Mistral Vibe prior to version 2.25.7 represents a critical remote code execution flaw rooted in the application's handling of Git repository configurations. This security issue stems from an insecure configuration mechanism where attackers can embed malicious filters, specifically targeting git clean or process filter drivers, within a crafted repository. The core technical failure lies in how the application initializes and processes these repositories upon user interaction. When a victim opens such a compromised repository, the software invokes ProjectContextProvider._fetch_git_status to retrieve status information. This function triggers a git status command which inherently respects and executes any configured filters defined in the .gitattributes file or local configuration without performing adequate validation of their source or intent.
This execution flow creates a severe security gap because the malicious commands are executed with the privileges of the currently logged-in user before any trust prompt or confirmation dialog is presented to the victim. In standard Git workflows, filter drivers can be used for various purposes such as content filtering or cleanup operations during checkout and commit processes. However, when these filters contain arbitrary code execution payloads, they become a potent attack vector. The attacker does not need direct access to the user's machine; instead, they only require the victim to open the malicious repository file within the Mistral Vibe interface. This bypasses traditional perimeter defenses since the exploit relies on social engineering tactics combined with legitimate software functionality.
The operational impact of this vulnerability is significant due to its remote nature and lack of pre-execution warnings. An attacker can achieve arbitrary code execution on the target system, potentially leading to full system compromise depending on the user's privilege level. This could result in data exfiltration, installation of persistent backdoors, or use of the compromised machine as a pivot point for further network attacks. The absence of a trust prompt means that users are unaware they are executing untrusted code, removing any opportunity for manual intervention to stop the attack. This aligns with common patterns seen in supply chain attacks where trusted tools are manipulated to execute malicious payloads under the guise of normal operation.
From an industry standards perspective, this vulnerability maps closely to CWE-94 Improper Control of Generation of Code or Command, specifically involving injection via configuration files. It also reflects weaknesses associated with CWE-20 Poor Input Validation and CWE-78 Improper Neutralization of Special Elements used in an OS Command. In terms of the MITRE ATT&CK framework, this exploit technique corresponds to T1059 Command and Scripting Interpreter abuse, where legitimate system utilities are leveraged for malicious purposes. The specific method of using Git filters aligns with techniques observed in advanced persistent threat groups that target developer tools and integrated development environments.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to upgrade Mistral Vibe to version 2.25.7 or later, where the developers have addressed this flaw by implementing stricter validation of filter configurations or disabling automatic execution of untrusted filters by default. For organizations unable to patch immediately, restricting user permissions to standard accounts with limited privileges can reduce the impact if exploitation occurs. Additionally, security awareness training should emphasize caution when opening repositories from unknown sources within IDEs and development tools that support Git integration. Implementing application whitelisting or endpoint detection and response solutions configured to monitor for suspicious git process executions may also provide an additional layer of defense against this specific attack vector.