Advisory · CVE-2026-93993
Mistral Vibe runs git hooks from untrusted repos before trust check
Mistral Vibe before 2.25.5 executes git hooks during worktree creation before trust validation, so opening a crafted repository can run arbitrary shell commands with the user's privileges. Fixed in 2.25.5.
- Vendor
- mistralai
- Product
- Mistral Vibe
- Identifier / CWE
- CVE-2026-93993
CWE-829 - Action timing
- Immediate
Explain it like I’m five
Vibe opens the front door of a strange house and lets the welcome mat do whatever it wants before checking whether the house is safe. A booby-trapped welcome mat runs a command with your keys.
- 01Crafted repository
The attacker supplies a repository containing a malicious post-checkout git hook.
- 02Worktree creation
The victim opens or clones the repository with Mistral Vibe before 2.25.5, triggering worktree creation.
- 03Hook runs early
Vibe executes the git hooks before performing trust validation on the repository.
- 04Arbitrary commands
The post-checkout hook runs arbitrary shell commands with the privileges of the user running Vibe.
What happened
Mistral Vibe versions before 2.25.5 contain a remote code execution flaw (CWE-829) in worktree creation. The tool executes git hooks before completing trust validation of the repository, so a crafted repository with a malicious post-checkout hook runs arbitrary shell commands with the privileges of the user running Vibe. The issue was reported in the project’s tracker (issue #996) and fixed in release 2.25.5 (commit c069ffa1).
Agentic coding tools routinely clone and open repositories from untrusted sources on behalf of users, which makes a trust-ordering bug like this a direct path from a malicious repo to code execution on the developer’s machine.
What to do
- Upgrade Mistral Vibe to 2.25.5 or later.
- If you opened repositories from untrusted sources with an affected version, review shell history, cron entries, and startup scripts on the affected machines for unauthorized changes.
- Treat any machine that opened an untrusted repo with an affected version as potentially compromised until checked.
- Prefer opening unknown repositories in isolated environments or containers regardless of version.
Management note
Developer tools that fetch and run code from the internet are part of the supply chain attack surface, and this one let the attacker run first and ask questions later. If your teams use AI coding assistants, pin minimum versions and treat them like any other internet-facing software: keep them patched.