CVE-2026-122133
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 04, 2026
Vendor
unknown
Description
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
References
- https://github.com/mistralai/mistral-vibe
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py#L137-L141
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py#L51-L64
- https://github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md?plain=1#L81
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553