Mistral Vibe CVE-2026-93993

Exploitation requires the victim to open, clone, or check out an attacker-controlled repository in Mistral Vibe before version 2.25.5, which triggers worktree creation; that process runs the repository's own git hooks (specifically post-checkout, and the fsmonitor command) prior to any workspace trust validation. Limiting factors: active user interaction is mandatory (the target must choose to load the malicious repo - there is no passive/remote-service exposure), code runs only with the privileges of the user running Vibe (no privilege escalation), and only versions before 2.25.5 are affected. There is no server-side or listening-service attack surface - the vulnerable trigger is local worktree handling of a delivered repository.

This is a genuine, credible RCE and should be treated as a priority for Mistral Vibe users, but the real-world blast radius is bounded by user interaction and product footprint. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, VC/VI/VA:H = 8.6 High) is internally consistent: no privileges needed and full compromise of confidentiality, integrity and availability, but active user interaction (UI:A) is mandatory - the victim must open, clone, or check out an attacker-supplied repository in Vibe. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - targeted rather than mass exploitation is the realistic model. There is no conflict between the CVSS network vector and the description: delivery is over the network (a hosted malicious repo) while execution is local to the developer's machine, which is exactly how git-hook trust-boundary bugs behave. The strongest mitigating signal is that a fixed release (v2.25.5) and a vendor patch commit are confirmed available, so remediation is a straightforward upgrade. Net: high technical severity, low likelihood of indiscriminate exploitation, elevated concern for developers who routinely clone untrusted repositories.

An attacker publishes a repository (or a malicious fork/PR branch) containing a crafted .git/hooks/post-checkout script. A developer opens or clones that repository in Mistral Vibe; during worktree creation Vibe checks out the tree and runs the repository's own post-checkout hook before performing trust validation, so the attacker's shell commands execute with the developer's privileges. No public exploit code is identified, but the technique is well understood and trivial to weaponize given the description and patch.