High priorityDisclosed

Advisory · CVE-2026-122133

Mistral Vibe on Windows runs planted git.exe before any trust prompt

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path flaw: opening a crafted repository can make the tool run a malicious git.exe placed in the repository root at session start, before any trust prompt. Rated high at CVSS 3.1 8.8.

Advisory published November 4, 2026Independent summary
Vendor
Mistral AI
Product
Mistral Vibe
Identifier / CWE
CVE-2026-122133
CWE-427
Action timing
Immediate
ELI5

Explain it like I’m five

When the coding agent opens a project, it looks for its helper tools in the project folder first. An attacker can leave a fake helper in that folder, and the agent runs it before ever asking whether the project is trusted.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted repository

    An attacker prepares a repository containing a malicious git.exe in its root and lures a user into opening it.

  2. 02Session start

    Mistral Vibe starts a session for the repository on Windows.

  3. 03Untrusted search path

    Session components run git from the repository directory before any trust prompt, picking up the planted executable.

  4. 04Code execution

    The malicious git.exe runs with the user's privileges.

What happened

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability. Attackers can lure users into opening a crafted repository so that session components run a malicious git.exe placed in the repository root at session start, before any trust prompt. The issue is rated high at CVSS 3.1 8.8 and affects Windows installations.

The fix is in Mistral Vibe 2.25.5; earlier versions are affected.

What to do

  1. Check the Mistral Vibe version on Windows workstations and upgrade to 2.25.5 or later.
  2. Avoid opening repositories from untrusted sources until upgraded, and be wary of repositories containing unexpected executables in their root.
  3. Review recently opened repositories for a git.exe or other unexpected executables in repository roots.
  4. If a planted executable is found, treat the workstation as compromised: remove it, investigate what it ran, and rotate credentials used on that machine.
  5. Confirm the deployed version after updating.

Management note

This is one of three Mistral Vibe flaws disclosed the same day that all break the same promise: nothing untrusted should run before the user approves the project. The pattern matters more than any single bug, so upgrade past all three fixes, not just this one.