{"id":"CVE-2026-122135","kind":"vulnerability","aliases":["CVE-2026-122135"],"related":[],"title":"Mistral Vibe: a crafted repository runs commands at session start","description":"Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute the attacker's program at session start, before any trust prompt.","summary":"Mistral Vibe before 3.0.3 runs git log during project context collection, and a repository can set gpg.program so git executes an attacker's program. The program runs at session start, before any trust prompt, so an attacker gets command execution on the developer's machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","coding-agent","git","mistral-vibe"],"not_affected_if":["trusted-repos-only","version-3.0.3-or-later"],"how_to_check":"- Check the installed Mistral Vibe version and confirm it is below `3.0.3`\n- Review repositories you open with Vibe for a `gpg.program` setting in `.git/config`, and `log.showSignature` enabled","fix":"- Mistral Vibe: move to `3.0.3` or later","status":"open","published_at":"2026-11-04T21:18:09+00:00","first_seen_at":"2026-11-04T21:49:20+00:00","triaged_at":"2026-11-04T21:50:35+00:00","updated_at":"2026-11-04T21:50:35+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T21:50:35Z","model":"claude-haiku-5-5","output":{"fix":"- Mistral Vibe: move to `3.0.3` or later","reach":"local","title":"Mistral Vibe: a crafted repository runs commands at session start","impact":"high","summary":"Mistral Vibe before 3.0.3 runs git log during project context collection, and a repository can set gpg.program so git executes an attacker's program. The program runs at session start, before any trust prompt, so an attacker gets command execution on the developer's machine.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mistral-vibe","coding-agent","git"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker's program runs as the developer on their machine","analyst_note":"Confirm from the NVD or vendor release notes whether a repository alone triggers it and what the 3.0.3 patch changed; the vulncheck advisory is the third-party source to check.","how_to_check":"- Check the installed Mistral Vibe version and confirm it is below `3.0.3`\n- Review repositories you open with Vibe for a `gpg.program` setting in `.git/config`, and `log.showSignature` enabled","plain_action":"","needs_analyst":true,"not_affected_if":["version-3.0.3-or-later","trusted-repos-only"],"who_is_affected":"Developers who run Mistral Vibe on a repository they did not write or fully trust, because the project's git config is read at session start. Teams that only use Vibe on their own trusted repositories and keep the version current are less exposed. The sources do not say whether managed or hosted use is involved.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4185,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122135':13A,16A '-2026':12A,15A '3.0.3':30B,75C 'abus':89C 'agent':22B 'ai':18B 'ai-tool':17B 'allow':83C 'attack':48B,63B,84C,114C 'code':21B,79C 'coding-ag':20B 'collect':37B,97C 'command':7A,65B,87C 'commit':108C 'configur':92C 'contain':76C 'context':36B,96C 'craft':4A,99C 'cve':11A,14A 'develop':69B 'execut':46B,66B,80C,112C 'get':64B 'git':23B,32B,45B,110C 'gpg.program':43B,93C,102C 'log':33B,111C 'log.showsignature':104C 'machin':71B 'make':109C 'mistral':1A,25B,27B,72C 'mistral-vib':24B 'program':50B,52B,116C 'project':35B,95C 'prompt':60B,123C 'remot':78C 'repositori':5A,40B,91C,100C 'repository-configur':90C 'run':6A,31B,53B,86C 'session':9A,55B,118C 'set':42B,101C 'sign':107C 'start':10A,56B,119C 'tool':19B 'trust':59B,122C 'vibe':2A,26B,28B,73C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Developers who run Mistral Vibe on a repository they did not write or fully trust, because the project's git config is read at session start. Teams that only use Vibe on their own trusted repositories and keep the version current are less exposed. The sources do not say whether managed or hosted use is involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","codingagent","git","high","mistralvibe"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122135","severity":null,"published_at":"2026-11-04T21:18:09+00:00","modified_at":"2026-11-04T21:18:09+00:00","first_seen_at":"2026-11-04T21:49:20+00:00","fetched_at":"2026-11-04T21:49:20+00:00","note":null}],"documents":[{"id":48037,"url":"https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":48038,"url":"https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70670,"url":"https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-repository-configured-gpg-program","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}