← All incidents

Two earlier Mistral Vibe CVEs, fixed before they were published: fsmonitor on any vibe command, post-checkout during worktree creation

Vulnerability · Mistral Vibe · HIGH

Summary

Two CVEs for Mistral Vibe, Mistral's coding agent, both published by VulnCheck with fixes that had already shipped. CVE-2026-67623, published Aug 5, 2026 at 10:17 AM ET, covers every release before 2.23.3: a repository can set core.fsmonitor in its own .git/config, and the command it names runs when Vibe calls git status --porcelain, which it does at session start. CVE-2026-93993, published Sep 19, 2026 at 7:17 PM ET, covers every release before 2.25.5: creating a worktree runs the repository's post-checkout hook before trust is checked. Both run code with the user's privileges. The fixes shipped first: 2.23.3 on Aug 3, 2026, two days before its CVE, and 2.25.5 on Sep 18, 2026, about a day and a half before its. Both floors sit well below 3.0.3, the version our Nov 4 entry sends readers to for the three newer Mistral Vibe CVEs, so anyone who followed that advice is already covered by these two. NVD lists both as Deferred, so NIST has not analyzed them and the descriptions are VulnCheck's. Neither appears in CISA's KEV catalog. We found no report that either was exploited. VulnCheck, the CNA, credits Mathieu Farrell as the finder on both.

Severity

Timeline

1. Jul 25, 2026, 3:13 PM ET
   GitHub issue 942, "[Security] Remote Code Execution via `git` configuration", is opened against the repository. Its body carries a script that builds a repository whose `core.fsmonitor` entry runs a command, and notes that the command runs before any trust dialog is shown. The payload in it writes the output of `id` and `env` to a file rather than doing anything else. The issue is closed Jul 31, 2026, 9:59 AM ET.
2. Aug 3, 2026, 9:00 AM ET
   Mistral Vibe v2.23.3 is released with the fix for CVE-2026-67623 (commit 68ff32e6, pull request 978). Its changelog line reads, "Git fsmonitor hook disabled in project context."
3. Aug 5, 2026, 10:17 AM ET
   VulnCheck, as CNA, publishes CVE-2026-67623. NVD lists it as Deferred; its description is VulnCheck's.
4. Aug 5, 2026, 11:32 AM ET
   The GitHub Advisory Database publishes GHSA-g6fr-w8c4-4935 for CVE-2026-67623, high at 8.8, unreviewed, with no package version data and no credits.
5. Aug 11, 2026, 6:12 PM ET
   GitHub issue 996, "[Security] Remote Code Execution via worktree creation (git hook execution)", is opened. Its body carries a script that writes a `.git/hooks/post-checkout` hook running `id`, and says the worktree is created, and the hook run, before the trust check. It is closed Sep 18, 2026, 6:57 AM ET, 12 minutes before the 2.25.5 release.
6. Sep 18, 2026, 7:09 AM ET
   v2.25.5 is released with the fix for CVE-2026-93993 (commit c069ffa1, pull request 1111). Its changelog line reads, "Creating or cleaning up a worktree no longer runs the repository's own git hooks (such as post-checkout) or its fsmonitor command."
7. Sep 19, 2026, 7:17 PM ET
   VulnCheck publishes CVE-2026-93993. NVD lists it as Deferred.
8. Sep 19, 2026, 8:30 PM ET
   GHSA-92v2-hh9v-6vj5 is published for CVE-2026-93993, high at 8.8, unreviewed, no package version data and no credits.
9. Nov 4, 2026
   We add this entry, after publishing the three newer Mistral Vibe CVEs on the same day.

How it happened

Both are cases of Vibe running Git, in a repository it has not yet asked the user to trust, in a way that lets the repository choose what command runs. CVE-2026-67623 (CWE-829): Git reads core.fsmonitor from a repository's own .git/config and runs the command it names when the index is refreshed. Vibe called git status --porcelain at session start through a helper in vibe/core/system_prompt.py, with no override, so a repository carrying an fsmonitor entry ran it. VulnCheck's description says this fires "when any vibe command is run inside that repository", with the victim's full privileges. The fix is a single flag: 2.23.3 calls git with -c core.fsmonitor= ahead of the subcommand, and -c on the command line outranks the repository's own config, so the repository cannot put it back. The source comment at the fixed call site says exactly why, that this runs unconditionally at session start before any trust prompt. We ran the hook both ways in a scratch repository: plain git status --porcelain fired it, the same call with -c core.fsmonitor= did not. CVE-2026-93993 (CWE-829): creating a worktree runs Git's post-checkout hook, and Vibe created worktrees during session setup, so a repository's own hook ran before the trust check. VulnCheck's description says this happens "in the worktree creation process" and that attackers "can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe". The fix routes the worktree call through a new helper, sanitized_git, which passes -c core.fsmonitor= and -c core.hooksPath=/nonexistent-vibe-disabled-git-hooks on every invocation, so the repository's own hooks directory is never consulted; the helper's comment explains that it takes an absolute path because git resolves a relative hooksPath against the untrusted worktree itself. The 2.25.5 notes describe the same change, and they also say the fsmonitor command is no longer run when a worktree is created or cleaned up. We checked that too: a worktree add against a repository with a post-checkout hook fired it, and the same call with the hooks path overridden did not, while pointing the override back at the real hooks directory fired it again. One thing this entry does not claim: that these two fixes closed every git call site in Vibe. They did not, and the third CVE in our Nov 4 entry is about git log, which is a different call. What 2.23.3 fixed is the status call at session start; what 2.25.5 fixed is the worktree hooks. On timing, both fixes shipped before any CVE or GitHub advisory existed, 2.23.3 about two days before CVE-2026-67623 and 2.25.5 about a day and a half before CVE-2026-93993. That is not the same as saying nothing was public. Issue 942, which carries a script that builds a repository whose fsmonitor entry runs a command, was opened on Jul 25, 2026, eight days before the 2.23.3 release, and issue 996, which carries a script that writes a post-checkout hook, was opened on Aug 11, 2026, 37 days before 2.25.5. Mistral published no advisory of its own for either: its advisory index stops at MAI-2026-003 on Sep 14, 2026, and its repository carries no security advisory page for these two.

How to check your app

• Run vibe --version. Anything at 3.0.3 or later covers both of these and the three newer CVEs. 2.25.5 or later covers these two; 2.23.3 or later covers the fsmonitor one.
• If you are pinned below 2.23.3, update, or check the repository's .git/config for a core.fsmonitor entry before you run any vibe command in it.
• If you are pinned between 2.23.3 and 2.25.4, the fsmonitor hook is disabled but worktree creation still runs a repository's own hooks.
• Neither fix protects a git call Vibe makes for some other reason, so treat an untrusted repository's .git/config and .git/hooks as code you are about to run, whatever version you are on. That is the same lesson as the three newer CVEs.

Sources

• NVD: CVE-2026-67623
• NVD: CVE-2026-93993
• VulnCheck advisory: arbitrary command execution via git fsmonitor hook
• VulnCheck advisory: RCE via git post-checkout
• Mistral Vibe v2.23.3 release
• Mistral Vibe v2.25.5 release
• Commit 68ff32e6: v2.23.3, the fsmonitor fix
• Commit c069ffa1: v2.25.5, the worktree hooks fix
• Pull request 978: v2.23.3
• Issue 942: fsmonitor hook executes on project open
• Issue 996: post-checkout hook runs during worktree creation
• GitHub Advisory Database GHSA-g6fr-w8c4-4935 (CVE-2026-67623)
• GitHub Advisory Database GHSA-92v2-hh9v-6vj5 (CVE-2026-93993)
• Mistral security advisories index
• Vibe source at the fixed call site, v2.23.3
• Vibe source at the worktree call site, v2.25.4 (before the fix)
• CISA KEV catalog 2026.11.04

Corrections and updates

None. Re-checked against every source on Nov 4, 2026.