CVE-2026-116843 Details
Description
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
A remote code execution vulnerability exists in Mistral Vibe versions prior to 3.0.3. This vulnerability allows attackers to execute commands by specifying git filter drivers in the .git/config of an untrusted repository. When the application is launched with the --worktree option, the git worktree add command applies .gitattributes and executes filter smudge, clean, or process commands before verifying folder trust. This sequence of actions results in the execution of malicious commands with the user's privileges.
Users can update to Mistral Vibe version 3.0.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mistralai/mistral-vibe/issues/997 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317 | [email protected] | Source CodeVendor |
| https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00 | [email protected] | Source CodeVendor |
| https://github.com/mistralai/mistral-vibe/issues/997 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mistral Vibe | >= 0, < 3.0.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |