CVE-2026-67623
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
05/08/2026
Last modified:
06/08/2026
Description
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.
Impact
Base Score 4.0
8.60
Severity 4.0
HIGH
Base Score 3.x
8.80
Severity 3.x
HIGH
References to Advisories, Solutions, and Tools
- https://github.com/mistralai/mistral-vibe/commit/68ff32e6a92e80a874c8153312f0aa8ae4955477
- https://github.com/mistralai/mistral-vibe/issues/942
- https://github.com/mistralai/mistral-vibe/pull/962
- https://github.com/mistralai/mistral-vibe/pull/978
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.23.3
- https://therealcoiffeur.com/c111011.html
- https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-via-git-fsmonitor-hook
- https://github.com/mistralai/mistral-vibe/issues/942