Three Mistral Vibe CVEs: opening a crafted repository ran code before the trust prompt

Vulnerability · Mistral Vibe · HIGH

Incident dateNot stated

DisclosedNov 4, 2026 (NVD, all three; VulnCheck is the CNA). Fixes released Sep 18, 2026 (2.25.5), Sep 22, 2026 (2.25.7) and Oct 26, 2026 (3.0.3).

Added hereNov 4, 4:45 PM ET

Last verifiedNov 4, 2026

Summary

NVD published three CVEs for Mistral Vibe, Mistral's coding agent, on Nov 4, 2026 at 4:18 PM ET, all with VulnCheck as the CNA. Each is a way to make code run at session start when the user opens a crafted repository, before Vibe shows its trust prompt: a planted git.exe found through an untrusted search path on Windows (CVE-2026-122133, fixed in 2.25.5), repository-configured Git clean or process filter drivers fired by Vibe's automatic git status call (CVE-2026-122134, fixed in 2.25.7), and a repository-configured gpg.program that git log runs while collecting project context (CVE-2026-122135, fixed in 3.0.3). VulnCheck scores each 8.8 High (CVSS 3.1) and 8.6 High (CVSS 4.0). NVD lists all three as Received, so NIST has not analyzed them. The fixes shipped between Sep 18 and Oct 26, 2026, but the third fix landed only in 3.0.3: every release from 2.25.8 through 3.0.2 still calls git log without --no-show-signature, so 2.25 and 2.26 readers alike have to move to 3.0.3 or later. These are separate from the two permission-bypass CVEs published Oct 13 and already on this site. VulnCheck, the CNA, credits Francisco Rosales of Manifold Security as the finder on all three. We found no report that any of the three is being exploited.

Severity

HIGH High (VibeIncidents editorial rating), matching VulnCheck's scores of 8.8 (CVSS 3.1) and 8.6 (CVSS 4.0) on each. The severity turns on timing: in all three the code runs before Vibe's trust prompt, so opening the wrong repository is the whole attack. Not Critical on our scale, because each one needs the user to open an attacker-controlled repository, none is reachable on its own over the network, and we found no report of exploitation. The fix floors matter here: 2.25.8, the last 2.25 release, and 2.26.1, the last 2.26 release, both still carry the third flaw, so neither line is safe.

Timeline

Sep 18, 2026, 7:09 AM ET
Mistral Vibe v2.25.5 ships the fix for CVE-2026-122133 (commit c069ffa1). The CHANGELOG line NVD cites reads, "Vibe no longer runs a project-local Git executable during automatic repository inspection."
Sep 22, 2026, 4:21 AM ET
v2.25.7 ships the fix for CVE-2026-122134 (commit 4a960031). Its CHANGELOG line reads, "Automatic project context no longer runs repository-configured Git clean or process filters."
Sep 23, 2026, 11:10 AM ET
v2.25.8 is released. It is the last 2.25 release and does not carry the fix for CVE-2026-122135. Its tagged source still calls git log with no --no-show-signature.
Oct 9, 2026, 10:56 AM ET
v2.26.1 is released, the last 2.26 release. It also does not carry the third fix; its tagged source still calls git log with no --no-show-signature.
Oct 26, 2026, 5:38 PM ET
v3.0.3 ships the fix for CVE-2026-122135 (commit 7bb48f21). Its CHANGELOG line reads, "Automatic project context no longer runs repository-configured Git signature verification programs." Its tagged source calls git log with --no-show-signature.
Nov 4, 2026, 4:18 PM ET
VulnCheck publishes CVE-2026-122133, CVE-2026-122134 and CVE-2026-122135. NVD lists all three as Received, with its own analysis still pending.
Nov 4, 2026, 4:32 PM ET
The GitHub Advisory Database publishes GHSA-4c2h-cpg4-cvr2, GHSA-3fw5-5q64-5hwx and GHSA-qx7j-gch3-gv7c for the three, all rated high at 8.8. Their descriptions repeat VulnCheck's text.

How it happened

All three reach the same place by different routes: Vibe reads Git state from the repository as a session starts, and does that before it asks the user to trust the project, so whatever the repository's own Git configuration points at runs first. CVE-2026-122133 (CWE-427, Windows only): NVD's description says that before 2.25.5 on Windows, Vibe contained "an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root," and that SessionLogger and ProjectContextProvider run that git.exe at session start, before any trust prompt. A git.exe committed to a repository root is found and run as though it were the real one. CVE-2026-122134 (CWE-829): NVD calls this "a remote code execution vulnerability" reached by "configuring malicious Git clean or process filter drivers in a repository." When the user opens the crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, the filters named in the repository's Git configuration fire, and their commands run with the user's privileges before the trust prompt. A repository you extract from an archive and open in place carries its own .git/config, so this needs no Windows and no planted executable. A plain clone does not copy the sender's config, which is why extracting into a scratch folder and checking that file before you open it is worth the minute. CVE-2026-122135 (CWE-829): NVD calls this one "a remote code execution vulnerability" too, reached by "abusing repository-configured gpg.program during project context collection": a repository that sets gpg.program and log.showSignature and holds a signed commit makes git log run the attacker's program at session start. Signature checking is the trigger, which is why turning it on in a repository's own config was enough. Why the fix advice is one floor and not three: Mistral shipped a separate fix per CVE, and the version numbers invite the reading that 2.25.5 or 2.25.7 covers the batch. It does not. The commit for CVE-2026-122135 (7bb48f21) is not an ancestor of v2.25.8 (GitHub's compare shows 9 commits behind) or of v2.26.1 (6 commits behind), and the source at both tags still calls git log without --no-show-signature, so the third vector survives on both lines through 3.0.2. v3.0.0 is ahead of both earlier fix commits, so 3.0.3 or later covers all three. Mistral has published no advisory for these three CVEs: its advisory index lists MAI-2026-003 (Sep 14, 2026) for the earlier shell permission bypasses and nothing newer for Vibe, and its repository has no security advisory of its own for them. The GitHub Advisory Database does carry all three, filed 14 minutes after the CVEs (4:32 PM ET against 4:18 PM ET), and those records repeat VulnCheck's text. The CVE descriptions are VulnCheck's, not Mistral's.

How to check your app

Run vibe --version. Anything below 3.0.3 leaves at least one of the three open; 3.1.0 is the current release.
If you are on 2.25.x or 2.26.x, move to 3.0.3 or later. 2.25.5 fixes the first CVE and 2.25.7 the second, but nothing below 3.0.3 fixes the third.
Before opening a repository you did not write, look at its .git/config for gpg.program, log.showSignature, filter, clean and process entries, and on Windows check the repository root for a git.exe.
Prefer cloning over opening a downloaded archive in place, and keep approval prompts on while you look through unfamiliar projects.

Sources

Corrections and updates

None. Re-checked against every source on Nov 4, 2026.

Cite this entry

Title: Three Mistral Vibe CVEs: opening a crafted repository ran code before the trust prompt
Added: Nov 4, 2026
URL: https://vibeincidents.com/incidents/mistral-vibe-repo-open-code-execution-cves-2026-11/
Suggested citation: VibeIncidents. "Three Mistral Vibe CVEs: opening a crafted repository ran code before the trust prompt." Nov 4, 2026. https://vibeincidents.com/incidents/mistral-vibe-repo-open-code-execution-cves-2026-11/