CVE-2026-93993 in Mistral Vibe
Summary
by MITRE • 09/20/2026
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The security flaw identified within Mistral Vibe versions prior to 2.25.5 represents a critical remote code execution vulnerability rooted in the application's handling of Git worktrees and associated hooks. This issue specifically affects the workflow where users open or clone repositories, triggering an automated process that creates local working directories known as worktrees. During this initialization phase, Mistral Vibe interacts with the underlying Git infrastructure to manage repository states. The core technical deficiency lies in the sequence of operations performed by the application when it encounters a post-checkout hook within the target repository. Instead of first validating whether the repository is trusted or safe for execution, the software proceeds to execute any executable scripts defined as hooks before completing this trust assessment. This inversion of security controls allows an attacker who can influence the contents of a Git repository accessed by a victim to inject malicious code that runs with elevated privileges.
From a technical perspective, the vulnerability exploits the standard behavior of Git where post-checkout hooks are designed to run automatically after a checkout operation completes. In this scenario, if a user opens a repository containing a crafted post-checkout hook script, Mistral Vibe will execute this script as part of its internal worktree creation logic. Because the trust validation step is deferred or bypassed relative to the execution event, there is no mechanism in place to sandbox or restrict the commands run by these hooks. Consequently, any shell command embedded within the malicious post-checkout hook is executed directly on the host system under the context and permissions of the user running Mistral Vibe. This effectively grants an attacker arbitrary code execution capabilities without requiring authentication or privilege escalation beyond what the victim already possesses.
The operational impact of this vulnerability is severe due to its potential for remote exploitation through social engineering or supply chain attacks. An adversary could distribute a malicious Git repository via email, messaging platforms, or public repositories and entice a target user with Mistral Vibe installed to open it. Upon opening, the application would automatically trigger the worktree creation process, leading to immediate execution of the attacker's payload. This can result in full system compromise, data exfiltration, installation of persistent backdoors, or lateral movement within an organization if the victim has access to sensitive network resources. The lack of explicit user interaction for this specific step means that victims may not realize they are executing untrusted code until significant damage has occurred.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically relates to CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). In terms of the MITRE ATT&CK framework, this behavior maps to T1059 Command and Scripting Interpreter, as it involves executing shell commands through a legitimate application feature. It also reflects aspects of supply chain compromise tactics where trust boundaries are violated during automated processes. The failure to enforce strict ordering between security validation and code execution is a fundamental architectural flaw that undermines the principle of least privilege and secure defaults.
Mitigation strategies must focus on immediate patching and defensive configuration changes until updates are applied. Users should upgrade Mistral Vibe to version 2.25.5 or later, where this race condition in hook execution versus trust validation has been resolved. In environments where upgrading is not immediately feasible, administrators can mitigate risk by configuring Git globally to disable automatic hook execution using the command git config --global core.hooksPath /dev/null on Unix-like systems or an empty directory on Windows, though this may impact legitimate development workflows requiring hooks. Additionally, organizations should enforce strict policies regarding which repositories users are permitted to open within collaborative tools and implement application whitelisting solutions that restrict script execution in untrusted directories. Security awareness training is also critical to help employees recognize suspicious repository sources before interacting with them through vulnerable applications.