Mistral Vibe: Remote code execution via git filter drivers in worktree mode
Summary
Mistral Vibe before 3.0.3 contains a remote code execution flaw in its worktree handling. When a user starts Vibe with --worktree on a malicious repository, git runs filter commands defined in that repository's .git/config before the trusted-folder check. An attacker can then run commands with the privileges of the user, which could expose source code and credentials on a developer workstation. The attack requires a malicious repository to reach the user and the user to add it as a worktree.
Affected
- Mistral Vibe versions before 3.0.3
- VulDB describes the flaw as up to 3.0.2, which matches this boundary
Fixed in
- Upgrade to Mistral Vibe 3.0.3 or later (GitHub release v3.0.3)
Workaround
Unknown. The vendor documents no workaround. Interim measures until patching:
- Add only trusted repositories as worktrees and avoid untrusted or external repositories
- Review repository .git/config files for suspicious git filter definitions
- Monitor for unusual process creation by git filters during worktree operations
Exploitation
- Not known to be exploited in the wild and not listed in CISA KEV
- The underlying mechanism is publicly described in GitHub issue #997
- Public proof of concept: Unknown
Our recommendation
- Check whether Mistral Vibe is installed on developer workstations, including unmanaged use, and record the versions
- Update Mistral Vibe to 3.0.3 or later
- Until patched, do not add untrusted or external repositories as worktrees and restrict use of the --worktree option
- Monitor developer endpoints for unexpected child processes started by git
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit (v3.0.3) github.com
- GitHub release v3.0.3 github.com
- VulnCheck advisory www.vulncheck.com
- GitHub issue #997 github.com
- Vulnerable code (worktree.py, v2.24.1) github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:03.
Original description (NVD)
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
NVD references (5)
- https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317
- https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00
- https://github.com/mistralai/mistral-vibe/issues/997
- https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3
- https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.