Cpe:2.3:a:mistral:mistral_vibe:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amistralmistral_vibe/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 22:09:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMistral Vibe: Untrusted search path remote code execution (CVE-2026-122133)https://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-cve/Wed, 04 Nov 2026 22:09:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-cve/Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows arbitrary code execution by placing a malicious git.exe in a repository root.Mistral Vibe versions before 2.25.5 on Windows are vulnerable to an untrusted search path flaw. The application components SessionLogger and ProjectContextProvider search for git.exe in the repository root upon session startup. An attacker can exploit this by placing a malicious git.exe in the root of a repository; when a user opens this repository, the malicious binary is executed automatically before any trust prompts are displayed.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user running the Mistral Vibe application.

Recommendation

  • Update Mistral Vibe to version 2.25.5 or later across all Windows workstations.
  • Implement file integrity monitoring for repositories to identify unexpected executables in root directories.
  • Warn developers to avoid cloning or opening repositories from untrusted or unknown sources.
]]>highadvisorywindowsrcevulnerability