{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amistralmistral_vibewindows/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mistral:mistral_vibe:*:*:*:*:*:windows:*:*","cpe:2.3:a:mistral:mistral_vibe:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-122133"},{"cvss":8.8,"id":"CVE-2026-122135"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mistral Vibe (\u003c 2.25.5)","Mistral Vibe (\u003c 3.0.3)"],"_cs_severities":["high"],"_cs_tags":["windows","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Mistral"],"content_html":"\u003cp\u003eMistral Vibe versions before 2.25.5 on Windows are vulnerable to an untrusted search path flaw. The application components SessionLogger and ProjectContextProvider search for git.exe in the repository root upon session startup. An attacker can exploit this by placing a malicious git.exe in the root of a repository; when a user opens this repository, the malicious binary is executed automatically before any trust prompts are displayed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the user running the Mistral Vibe application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Mistral Vibe to version 2.25.5 or later across all Windows workstations.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring for repositories to identify unexpected executables in root directories.\u003c/li\u003e\n\u003cli\u003eWarn developers to avoid cloning or opening repositories from untrusted or unknown sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T22:09:57Z","date_published":"2026-11-04T22:09:42Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-cve/","summary":"Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows arbitrary code execution by placing a malicious git.exe in a repository root.","title":"Mistral Vibe: Untrusted search path remote code execution (CVE-2026-122133)","url":"https://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-cve/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mistral:mistral_vibe:*:*:*:*:*:windows:*:*","version":"https://jsonfeed.org/version/1.1"}