Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-93993: Mistral Vibe lets attackers run code remotely

CVE-2026-93993 · published 11 days ago

Summary

Versions of Mistral Vibe before 2.25.5 can run malicious commands when they process a specially crafted Git repository. An attacker could cause the software to execute any command with the same rights as the user running Vibe. Upgrade to version 2.25.5 or later to stop this behavior.

What to do

Update mistralai mistral-vibe to version 2.25.5 or later.

Affected software

Vendor	Product	Affected versions
mistralai	mistral-vibe	< 2.25.5

Original advisory text

Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

References

https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab... Patch
https://github.com/mistralai/mistral-vibe/issues/996 Third Party Advisory
https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5 Vendor Advisory
https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-remote-code-exec... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93993... Vendor Advisory
https://github.com/mistralai/mistral-vibe/blob/19b5b74faa78d0816b8d4d4c7d7543fc3... Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-93993 Vendor Advisory
https://github.com/mistralai/mistral-vibe Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-829Inclusion of Functionality from Untrusted Control Sphere

Timeline

Published19 Sep 2026

Updated30 Sep 2026

First seen19 Sep 2026

Sources

CVE-2026-93993 · NVD

CVE-2026-93993 · MITRE

CVE-2026-93993 · OSV

Track software like this

Free during beta