Mistral Vibe EUVD-2026-110574

Exploitation requires that the user launch Mistral Vibe with the --worktree flag and point it at an attacker-controlled or otherwise untrusted git repository that contains a crafted .git/config defining filter drivers (smudge, clean, or process) plus a .gitattributes binding those filters to files. The root cause is ordering: git worktree add applies .gitattributes and runs the filter commands before Vibe performs its trusted-folder check, so the attacker's commands execute with the invoking user's privileges. Limiting factors that reduce realistic risk: the --worktree mode must be in use, the victim must actively add the malicious repository (passive user interaction, UI:P), and the installation must be a version before 3.0.3; code runs only with the user's existing privileges (no scope change, SC/SI/SA:N).

Signals point to a genuine but non-emergency priority. The CVSS 4.0 base score of 8.7 (High) reflects network-reachable, low-complexity, unauthenticated code execution (AV:N/AC:L/AT:N/PR:N) with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), tempered only by passive user interaction (UI:P). Against that, EPSS is low at 0.43% (37th percentile), the CVE is not listed in CISA KEV, and no exploit code is marked as confirmed public, which argues against widespread opportunistic exploitation. The vuln.today decision label is 'this_week', consistent with a serious flaw that should be remediated promptly but is not under active mass exploitation. The key tension to flag: CVSS treats this as PR:N/UI:P 'network' RCE, but the mechanism is contextual - the victim must run Mistral Vibe with the --worktree flag against an attacker-controlled repository, so real-world risk is closer to targeted social-engineering/supply-chain of developer workflows than internet-facing remote exploitation. Net: a real priority for anyone using mistral-vibe worktree mode on untrusted repos, but not an emergency given low EPSS and no confirmed active exploitation.

An attacker publishes or sends a victim a malicious git repository whose .git/config defines git filter drivers (smudge/clean/process) and whose .gitattributes bind them to files. A developer running Mistral Vibe with --worktree adds that repository; git worktree add applies .gitattributes and executes the filter commands before Vibe's trusted-folder check, running the attacker's commands with the user's privileges. The VulnCheck advisory and GitHub issue #997 describe this mechanism, though no exploit is marked as confirmed public code.