Mistral Vibe CVE-2026-67623

Exploitation requires that the victim run Mistral Vibe (any version before 2.23.3) with its working directory set to, or inside, a repository that contains a malicious core.fsmonitor entry in its .git/config file. The victim does not need to manually inspect or open the config file - simply running any vibe command (e.g., opening a project, running a chat, invoking an agent action) while inside the repository is sufficient to trigger execution. The attacker has no required authentication or system access; their only requirement is delivering the crafted repository to the victim, which can occur via cloning a public repository, receiving a zip/archive, or any supply-chain channel. Exploitation is limited by the requirement for victim interaction (UI:A): the victim must actively invoke Mistral Vibe within the malicious repository. The attack does not succeed against default-configuration repositories that lack a core.fsmonitor entry, and cannot be triggered remotely against arbitrary Vibe instances without delivery of the crafted repo.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A) accurately reflects the risk profile: network-deliverable via repository distribution, low attack complexity, no attacker privileges required, but victim interaction is mandatory (the victim must invoke Mistral Vibe within the crafted repository). The full C:H/I:H/VA:H impact reflects that arbitrary OS-level command execution with the victim's privileges is the outcome. No CISA KEV listing exists, and no POC is referenced in the source data - these are meaningful moderating signals that reduce urgency compared to, say, a Log4Shell-class remotely triggerable issue. EPSS data is not provided; however, the attack pattern is well-understood and the barrier to exploitation is social engineering or supply-chain delivery, not technical sophistication. Organizations whose developers use Mistral Vibe in workflows that pull external or untrusted repositories face real, non-theoretical risk and should treat this as a high priority for patching, despite the absence of confirmed exploitation.

An attacker creates a git repository containing a .git/config with a core.fsmonitor entry set to a malicious shell command (e.g., a reverse shell or credential exfiltration payload), then distributes the repository via a public platform, phishing link, or by contributing it to a project the victim works with. When the victim clones or opens the repository and runs any Mistral Vibe command, Vibe internally invokes git status --porcelain, which causes git to execute the fsmonitor hook, running the attacker's payload immediately with the victim's full user privileges. No public POC has been identified at time of analysis, but the technique requires minimal skill given the class is well-documented in prior git hook abuse research.