Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-122134: Mistral Vibe lets attackers run code via Git filters

CVE-2026-122134 · published 5 days ago

Summary

The Mistral Vibe application (versions before 2.25.7) can be tricked into executing malicious commands when it processes a specially crafted Git repository. Opening such a repository causes the program to run the attacker’s code with the same privileges as the user, potentially compromising the system. Update to version 2.25.7 or later, or avoid opening untrusted repositories, to protect against this risk.

What to do

Update mistralai mistral-vibe to version 2.25.7 or later.

Affected software

Vendor	Product	Affected versions
mistralai	mistral-vibe	< 2.25.7

Original advisory text

Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.

References

https://github.com/mistralai/mistral-vibe/commit/4a96003186b166d55b9f06895c45bb1... patch
https://github.com/mistralai/mistral-vibe product
https://github.com/mistralai/mistral-vibe/blob/v2.25.7/CHANGELOG.md?plain=1#L17 release-notes
https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.7 release-notes
https://github.com/mistralai/mistral-vibe/blob/v2.25.5/vibe/core/system_prompt.p... technical-description
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-1221... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-122134 Vendor Advisory
https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.7-code-execution-v... third-party-advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-829Inclusion of Functionality from Untrusted Control Sphere

Timeline

Published4 Nov 2026

Updated9 Nov 2026

First seen4 Nov 2026

Sources

CVE-2026-122134 · NVD

CVE-2026-122134 · MITRE

CVE-2026-122134 · OSV

Track software like this

Free during beta