High priorityDisclosed

Advisory · CVE-2026-122135

Mistral Vibe runs repository-configured gpg.program before any trust prompt

Mistral Vibe before 3.0.3 contains a remote code execution flaw: a crafted repository can set gpg.program and signature display options so that Git log executes the attacker's program during project context collection, before any trust prompt. Rated high at CVSS 3.1 8.8.

Advisory published November 4, 2026Independent summary
Vendor
Mistral AI
Product
Mistral Vibe
Identifier / CWE
CVE-2026-122135
CWE-829
Action timing
Immediate
ELI5

Explain it like I’m five

A project can name its own signing helper program. The coding agent reads the project's commit history before asking whether it is trusted, and Git runs the named helper, which is the attacker's program.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted repository

    An attacker prepares a repository setting gpg.program to their program, enabling signature display, and including a signed commit.

  2. 02Project context collection

    Mistral Vibe collects project context at session start and runs Git log.

  3. 03Attacker program invoked

    Git log invokes the repository-configured gpg.program before any trust prompt.

  4. 04Code execution

    The attacker's program executes with the user's privileges.

What happened

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability. Attackers can run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and signature display options, with a signed commit, makes Git log execute the attacker’s program at session start, before any trust prompt. The issue is rated high at CVSS 3.1 8.8.

The fix is in Mistral Vibe 3.0.3; earlier versions are affected. Note the fix version differs from the other two Mistral Vibe flaws disclosed the same day, so upgrading to the latest release covers all three.

What to do

  1. Check the Mistral Vibe version on developer workstations and upgrade to 3.0.3 or later.
  2. Avoid opening repositories from untrusted sources until upgraded.
  3. Inspect repository Git configuration for unexpected gpg.program settings before opening unfamiliar projects.
  4. If a malicious setting is found, treat the workstation as compromised: investigate what the program ran and rotate credentials used on that machine.
  5. Confirm the deployed version after updating.

Management note

Three flaws, one lesson: an AI coding agent must not execute anything a repository dictates before the user trusts that repository. Until the upgrade lands, every unfamiliar clone is a potential code execution vector.