Which Mistral Vibe version fixes all three flaws?

Mistral Vibe 3.0.3 carries all three fixes. VulnCheck lists 2.25.5 as the fix for the Windows git.exe search-path flaw, 2.25.7 for the Git filter-driver flaw, and 3.0.3 for the gpg.program flaw. Because the fixes are cumulative, updating straight to 3.0.3 or later closes every one of them in a single step.

Does Vibe's trusted-folder prompt stop these attacks?

The trusted-folder prompt does not stop them. All three VulnCheck advisories state that the attacker's code runs at session start, before any trust prompt is shown. Mistral Vibe gathers project context and writes session logs by calling Git first, so a repository's own Git settings take effect while the user is still deciding whether to trust the folder.

Am I exposed if I only open repositories I wrote myself?

Repositories you wrote yourself carry no attacker-controlled Git configuration, so the risk is low. Exposure comes from opening someone else's checkout: a cloned pull request branch, a bug report reproduction, a dependency vendored into a working tree, or any archive a third party sent you. Reviewing a repository's .git/config and .gitattributes before starting Vibe reduces the risk further.

Is the Windows git.exe flaw different from the other two?

The Windows flaw, CVE-2026-122133, abuses a search path rather than a Git setting. A malicious git.exe sitting in the repository root is executed by Vibe's SessionLogger and ProjectContextProvider instead of the real Git binary. VulnCheck classes it as CWE-427, uncontrolled search path element, while the other two are CWE-829, inclusion of functionality from an untrusted control sphere.

HIGHVulnerability

Mistral Vibe: a crafted repo runs code before the trust prompt

Three flaws let a crafted Git repository run commands in Mistral Vibe at session start, before the trust prompt appears.

November 4, 2026 · VulnCheck · Research by Francisco Rosales (Manifold Security)

CVE-2026-122135

HIGHVulnerability

Mistral Vibe ran commands from a repository's own Git configuration at session start, before the trust prompt appeared. Francisco Rosales of Manifold Security found three such flaws, all fixed by version 3.0.3.

01What happened

VulnCheck published three advisories for Mistral Vibe, Mistral's open-source CLI coding assistant, on 4 November 2026. Francisco Rosales of Manifold Security found all three. Each one lets a repository the user did not write run commands as soon as a Vibe session starts.

02How it works

Mistral Vibe builds its project context by shelling out to Git, and a repository can control what Git does. Setting gpg.program together with log.showSignature makes git log run the attacker's program on a signed commit. Git clean or process filter drivers defined in the repository are invoked when git status runs. On Windows, Vibe picked up a git.exe placed in the repository root instead of the system one.

03Who is affected

Anyone who starts a Mistral Vibe session inside a repository from an untrusted source. The gpg.program flaw affects every version below 3.0.3 on all platforms. The filter-driver flaw was fixed in 2.25.7, and the git.exe search-path flaw affects Windows only and was fixed in 2.25.5.

04What to do

Update Mistral Vibe to 3.0.3 or later, which carries all three fixes. Until the update is in place, do not open a Vibe session in a repository you did not write or review.

Questions people ask

Which Mistral Vibe version fixes all three flaws?: Mistral Vibe 3.0.3 carries all three fixes. VulnCheck lists 2.25.5 as the fix for the Windows git.exe search-path flaw, 2.25.7 for the Git filter-driver flaw, and 3.0.3 for the gpg.program flaw. Because the fixes are cumulative, updating straight to 3.0.3 or later closes every one of them in a single step.
Does Vibe's trusted-folder prompt stop these attacks?: The trusted-folder prompt does not stop them. All three VulnCheck advisories state that the attacker's code runs at session start, before any trust prompt is shown. Mistral Vibe gathers project context and writes session logs by calling Git first, so a repository's own Git settings take effect while the user is still deciding whether to trust the folder.
Am I exposed if I only open repositories I wrote myself?: Repositories you wrote yourself carry no attacker-controlled Git configuration, so the risk is low. Exposure comes from opening someone else's checkout: a cloned pull request branch, a bug report reproduction, a dependency vendored into a working tree, or any archive a third party sent you. Reviewing a repository's .git/config and .gitattributes before starting Vibe reduces the risk further.
Is the Windows git.exe flaw different from the other two?: The Windows flaw, CVE-2026-122133, abuses a search path rather than a Git setting. A malicious git.exe sitting in the repository root is executed by Vibe's SessionLogger and ProjectContextProvider instead of the real Git binary. VulnCheck classes it as CWE-427, uncontrolled search path element, while the other two are CWE-829, inclusion of functionality from an untrusted control sphere.

Sources 5 links, all fetched

1vulncheck.comVulnCheck Advisory
2vulncheck.comGit Filter Drivers
3vulncheck.comWindows git.exe RCE
4github.comGitHub Advisory
5github.comVibe 3.0.3 Release