{"id":"CVE-2026-116843","kind":"vulnerability","aliases":["CVE-2026-116843"],"related":[],"title":"Mistral Vibe: untrusted git repo runs attacker commands on worktree start","description":"Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.","summary":"Mistral Vibe before 3.0.3 reads git filter driver definitions from an untrusted repository's .git/config when started with --worktree. The attacker's smudge, clean or process commands run with the user's privileges before the trusted-folder check.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","coding-agent","developer-workstations","git","mistral-vibe"],"not_affected_if":["fixed-version","no-worktree-flag","trusted-repos-only"],"how_to_check":"- Check the installed Mistral Vibe version with `vibe --version` (exact command unknown; confirm in the package manifest)\n- Look for Mistral Vibe runs using the `--worktree` flag in shell history or launch scripts\n- Inspect untrusted repositories' `.git/config` for `filter.*` entries with smudge, clean or process commands","fix":"- Upgrade Mistral Vibe to `3.0.3` or later\n- Until upgraded, avoid running Mistral Vibe with `--worktree` on repositories you did not create","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:13+00:00","updated_at":"2026-10-27T01:36:13+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T01:36:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mistral Vibe to `3.0.3` or later\n- Until upgraded, avoid running Mistral Vibe with `--worktree` on repositories you did not create","reach":"local","title":"Mistral Vibe: untrusted git repo runs attacker commands on worktree start","impact":"high","summary":"Mistral Vibe before 3.0.3 reads git filter driver definitions from an untrusted repository's .git/config when started with --worktree. The attacker's smudge, clean or process commands run with the user's privileges before the trusted-folder check.","category":"ai-tooling","nicknames":[],"who_cares":["mistral-vibe","coding-agent","git","developer-workstations"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker commands run with the developer's user privileges on their machine","analyst_note":"Confirm the exact trigger and the vibe version command from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116843.","how_to_check":"- Check the installed Mistral Vibe version with `vibe --version` (exact command unknown; confirm in the package manifest)\n- Look for Mistral Vibe runs using the `--worktree` flag in shell history or launch scripts\n- Inspect untrusted repositories' `.git/config` for `filter.*` entries with smudge, clean or process commands","needs_analyst":true,"not_affected_if":["fixed-version","trusted-repos-only","no-worktree-flag"],"who_is_affected":"Developers who run Mistral Vibe with the --worktree option on repositories they did not write, such as cloned third-party code or pull request branches. Teams that only use Mistral Vibe on trusted repositories they control, or on versions 3.0.3 and later, are not exposed by this flaw.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3342,"output_tokens":670,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116843':14A,17A '-2026':13A,16A '3.0.3':34B,73C 'add':103C 'agent':23B 'ai':19B 'ai-tool':18B 'allow':81C 'appli':104C 'attack':7A,51B,82C,121C 'check':69B,119C 'clean':54B,110C 'code':22B,77C 'coding-ag':21B 'command':8A,57B,85C,113C,122C 'contain':74C 'cve':12A,15A 'defin':87C 'definit':39B 'develop':25B 'developer-workst':24B 'driver':38B,90C 'execut':78C,120C 'filter':37B,89C,108C 'folder':68B,118C 'git':4A,27B,36B,88C,101C 'git/config':45B,96C 'gitattribut':105C 'mistral':1A,29B,31B,70C 'mistral-vib':28B 'privileg':63B,125C 'process':56B,112C 'read':35B 'remot':76C 'repo':5A 'repositori':43B,94C 'run':6A,58B,84C,107C 'smudg':53B,109C 'start':11A,47B,98C 'tool':20B 'trust':67B,117C 'trusted-fold':66B,116C 'untrust':3A,42B,93C 'user':61B,124C 'vibe':2A,30B,32B,71C 'vulner':79C 'workstat':26B 'worktre':10A,49B,100C,102C","nicknames":[],"mitigations":[],"who_affected":"Developers who run Mistral Vibe with the --worktree option on repositories they did not write, such as cloned third-party code or pull request branches. Teams that only use Mistral Vibe on trusted repositories they control, or on versions 3.0.3 and later, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116843","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}