{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mistral-vibe--2.25.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mistral:mistral_vibe:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-122134"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mistral Vibe (\u003c 2.25.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Mistral AI"],"content_html":"\u003cp\u003eMistral Vibe prior to version 2.25.7 contains a remote code execution vulnerability (CVE-2026-122134). The vulnerability originates in the ProjectContextProvider component, which automatically executes \u003ccode\u003egit status\u003c/code\u003e when a user opens a repository. An attacker can create a crafted Git repository containing malicious clean or process filter drivers. When a user opens this repository in Mistral Vibe, the application invokes these filters, leading to arbitrary code execution with the user privileges before any user trust prompts occur.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the victim's machine under the context of the user account running Mistral Vibe.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Mistral Vibe to version 2.25.7 or later to mitigate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement endpoint policies to restrict the execution of Git processes from non-standard or untrusted directory structures if possible.\u003c/li\u003e\n\u003cli\u003eMonitor for child processes spawned by Mistral Vibe or Git processes initiated from unusual project directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T00:21:19Z","date_published":"2026-11-05T00:21:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-rce/","summary":"Mistral Vibe versions before 2.25.7 are vulnerable to remote code execution due to the automatic execution of git commands on untrusted repositories.","title":"Mistral Vibe: Remote code execution via Git filter drivers (CVE-2026-122134)","url":"https://feed.craftedsignal.io/briefs/2026-11-mistral-vibe-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Mistral Vibe (\u003c 2.25.7)","version":"https://jsonfeed.org/version/1.1"}