Mistral Vibe: Remote code execution via Git filter drivers (CVE-2026-122134)

Mistral Vibe prior to version 2.25.7 contains a remote code execution vulnerability (CVE-2026-122134). The vulnerability originates in the ProjectContextProvider component, which automatically executes git status when a user opens a repository. An attacker can create a crafted Git repository containing malicious clean or process filter drivers. When a user opens this repository in Mistral Vibe, the application invokes these filters, leading to arbitrary code execution with the user privileges before any user trust prompts occur.

Impact

Successful exploitation allows for arbitrary code execution on the victim's machine under the context of the user account running Mistral Vibe.

Recommendation

• Update Mistral Vibe to version 2.25.7 or later to mitigate the vulnerability.
• Implement endpoint policies to restrict the execution of Git processes from non-standard or untrusted directory structures if possible.
• Monitor for child processes spawned by Mistral Vibe or Git processes initiated from unusual project directories.