CVE-2026-122133
8.8 HIGHpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-427
Public exploit & PoC references
- https://github.com/mistralai/mistral-vibe
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py#L137-L141
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py#L51-L64
- https://github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md?plain=1#L81
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
All references
- https://github.com/mistralai/mistral-vibe
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py#L137-L141
- https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py#L51-L64
- https://github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md?plain=1#L81
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
- https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-on-windows-untrusted-search-path-rce-via-git-exe
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-102438
- HIGHCVE-2026-103665
- HIGHCVE-2026-103845
- HIGHCVE-2026-104349
- UNSCOREDCVE-2026-104809
- HIGHCVE-2026-106186
- HIGHCVE-2026-107615
- CRITICALCVE-2026-108390PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.