← CVE Radar
CVE-2026-122133Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
8.6 HIGHEPSS 0.37%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.6 | HIGH | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 8.8 | HIGH | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-122133
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 4, 2026
- Last modified
- 2026-11-05 20:17 UTC
- Weaknesses
- CWE-427 · Uncontrolled Search Path Element
Affected Products
As published by the CNA in the CVE record.
mistralaimistral-vibe1 version range
- before 2.25.5
References
- github.com https://github.com/mistralai/mistral-vibe
- github.com https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py#L137-L141
- github.com https://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py#L51-L64
- github.com https://github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md?plain=1#L81
- github.com https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
- github.com https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
- vulncheck.com https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-on-windows-untrusted-search-path-rce-via-git-exe