CVE-2026-93993
published 2026-09-19CVE-2026-93993: Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation…
PriorityP259high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.77%
54.1th percentile
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mistralai | mistral-vibe | < 2.25.5 | 2.25.5 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mistral AI Mistral Vibe up to 2.25.4 Worktree Creation Process os command injection
vuldb·2026-09-20·CVSS 8.8
CVE-2026-93993 [HIGH] Mistral AI Mistral Vibe up to 2.25.4 Worktree Creation Process os command injection
A vulnerability identified as problematic has been detected in Mistral AI Mistral Vibe up to 2.25.4. This issue affects some unknown processing of the component Worktree Creation Process. This manipulation causes os command injection.
This vulnerability appears as CVE-2026-93993. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
GHSA
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation.
ghsa_unreviewed·2026-09-20
CVE-2026-93993 [HIGH] CWE-829 Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation.
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/mistralai/mistral-vibehttps://github.com/mistralai/mistral-vibe/blob/19b5b74faa78d0816b8d4d4c7d7543fc3520678c/vibe/core/git/repo.py#L411-L431https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553https://github.com/mistralai/mistral-vibe/issues/996https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-remote-code-execution-via-git-post-checkouthttps://github.com/mistralai/mistral-vibe/issues/996
2026-09-19
Published