Remote Code Execution Vulnerability in Mistral Vibe by Mistral AI
CVE-2026-116843

8.7HIGH

Key Information:

Vendor

Mistralai

Status
Mistral-vibe
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116843?

A remote code execution vulnerability exists in Mistral Vibe prior to version 3.0.3. This issue arises when attackers exploit git filter drivers in an untrusted repository's .git/config. When initiating with --worktree, the git worktree add command processes .gitattributes, executing filter commands before verifying trusted folders, potentially allowing attackers to execute their commands with user privileges.

Affected Version(s)

mistral-vibe 0 < 3.0.3

References

https://github.com/mistralai/mistral-vibe/issues/997
issue-tracking
https://github.com/mistralai/mistral-vibe/commit/7bb48f21...
patch
https://github.com/mistralai/mistral-vibe/releases/tag/v3...
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mathieu Farrell
.