mistral-vibe on Windows runs attacker's git.exe from repository root

Opening a crafted folder can hack Windows PCs.

Summary

Mistral Vibe before 2.25.5 on Windows runs a git.exe placed in the repository root when a session starts, so attackers can execute code. Attackers can lure users into opening a crafted repository.

Affected when

Windows
Before 2.25.5
Opening a crafted repository

What to do

Update to 2.25.5 or later.

Products and platforms

Windows
mistral-vibe

CVE IDs

CVE-2026-122133 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 20:36 UTC

First seen 2026-11-09 16:00 UTC