Mistral Vibe runs commands via malicious Git filter drivers

An AI coding tool can be hacked when it opens a malicious project.

Summary

Mistral Vibe before 2.25.7 lets attackers run commands if a user opens a crafted Git repository. The commands run with the user's privileges, before any trust prompt appears.

Affected when

Opening a crafted repository
Mistral Vibe before 2.25.7

What to do

Update to Mistral Vibe 2.25.7 or later.

Products and platforms

Windows
macOS
Linux
mistral-vibe

CVE IDs

CVE-2026-122134 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 20:36 UTC

First seen 2026-11-09 16:00 UTC