Advisory · CVE-2026-116843
Mistral Vibe runs an untrusted repository's git filters before the trust check, giving command execution
Mistral Vibe before 3.0.3 runs git filter drivers defined in an untrusted repository's own configuration when creating a worktree, before the trusted-folder check, so opening a crafted repository with --worktree executes attacker commands with the user's privileges. CVSS 3.1 8.8.
- Vendor
- Mistral AI
- Product
- Mistral Vibe
- Identifier / CWE
- CVE-2026-116843
CWE-829 - Action timing
- Immediate
Explain it like I’m five
Vibe is supposed to ask whether you trust a new project before running anything from it. Instead, setting up a separate work area for the project quietly ran the project's own git helper commands first, so a booby-trapped project could run commands on your machine before you ever said you trusted it.
- 01Untrusted repository opened
A user clones a repository an attacker controls and starts Mistral Vibe in it with the --worktree option.
- 02Worktree creation begins
Vibe runs git worktree add, which applies the repository's .gitattributes and reads filter drivers from the repository's own git configuration.
- 03Filter commands execute
The repository-defined smudge, clean, or process filter commands run on the user's machine.
- 04Trust check comes too late
The commands execute before Vibe's trusted-folder check, so the code runs whether or not the user ever trusted the repository.
- 05User privileges gained
The attacker commands run with the Vibe user's privileges, with access to that user's files, credentials, and network reach.
What happened
NVD published CVE-2026-116843 on October 27, 2026, rating it high at CVSS 3.1 8.8 (CVSS 4.0 8.7). The entry states that Mistral Vibe versions before 3.0.3 are affected: when Vibe is started with –worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands defined in the untrusted repository’s git configuration, and it does so before the trusted-folder check, executing attacker commands with the user’s privileges (CWE-829).
The vendor’s 3.0.3 release notes confirm the fix in the project’s own words: creating a worktree no longer runs file filters defined by the repository’s own Git configuration before the folder is trusted, and automatic project context no longer runs repository-configured Git signature verification programs. Per the affected data in the NVD record, versions before 3.0.3 are affected and 3.0.3 is listed as unaffected, so upgrading to Mistral Vibe 3.0.3 or later is the stated fix.
What to do
- Inventory Mistral Vibe installations on developer workstations, shared machines, and CI or automation hosts, and note the version of each.
- Upgrade affected installations to Mistral Vibe 3.0.3 or later.
- Until every installation is upgraded, do not open untrusted or newly cloned repositories with the –worktree option, and treat any repository from an unknown source as untrusted code.
- For any workstation that opened an untrusted repository with an affected version, review shell history, running processes, and recently created or modified files for commands you did not run, and check which git filter drivers the repository defines.
- Rotate developer credentials, tokens, and keys reachable from any workstation where a suspicious repository was opened with an affected version and filter execution cannot be excluded.
- Verify the deployed version after updating, including copies installed through package managers and bundled in tool images.
Management note
Coding agents inherit the trust problem of the repositories they open: project setup steps are code execution, even when they arrive dressed as git configuration. The patch restores the intended order, trust first and execution second. Keep AI coding tools on the same fast patch ring as browsers and IDEs, because a cloned repository is now an attack delivery format.