EUVD-2026-53342
GHSA-g6fr-w8c4-4935
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery via repository, no attacker privileges, low complexity, but victim must invoke Vibe in the repo (UI:R); scope unchanged as execution stays within victim's user context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.
AnalysisAI
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.
Technical ContextAI
Git's core.fsmonitor configuration key specifies an external process git will invoke before executing status operations to query filesystem change state - it is designed for performance optimization but can reference arbitrary shell commands. Mistral Vibe, an AI-assisted coding agent (CPE: cpe:2.3:a:mistralai:mistral-vibe:*:*:*:*:*:*:*:*), invokes git status --porcelain as part of its project context acquisition without setting GIT_CONFIG_NOSYSTEM, using --no-plugins, or otherwise suppressing local repository hook execution. This falls squarely under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): the application unconditionally inherits and executes configuration from an untrusted repository-local source. The attack class is well-understood - analogous vulnerabilities have been documented in GitHub Desktop, VS Code, and other tools that shell out to git without sandboxing repository-level configuration.
RemediationAI
The primary fix is upgrading to Mistral Vibe v2.23.3 or later, which explicitly disables the git fsmonitor hook in project context as confirmed by the release notes at https://github.com/mistralai/mistral-vibe/releases/tag/v2.23.3. The underlying commit is available at https://github.com/mistralai/mistral-vibe/commit/68ff32e6a92e80a874c8153312f0aa8ae4955477. If immediate upgrade is not possible, the most actionable compensating control is restricting Mistral Vibe usage to repositories from fully trusted, internally controlled sources - do not run Vibe inside cloned external or third-party repositories until patched. A secondary measure is to inspect .git/config in any repository before invoking Vibe and verify that core.fsmonitor is either absent or points to a known-good path; note this is a manual, error-prone process and is not a reliable long-term mitigation. Setting the git global config option core.fsmonitor=false in the user's global gitconfig does not reliably override per-repository config in all git versions and should not be relied upon as a sole control.
More in Mistral Vibe
View allArbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially mod
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval a
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping mali
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or over
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers
Share
External POC / Exploit Code
Leaving vuln.today