CVE-2026-93993
Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
CVSS 4.0 8.6 HIGHCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-93993
PublishedMistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-93993 · CVE overview and exploitation status
cve-program · CVE-2026-93993
- https://github.com/mistralai/mistral-vibe/issues/996
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
- https://github.com/mistralai/mistral-vibe/blob/19b5b74faa78d0816b8d4d4c7d7543fc3520678c/vibe/core/git/repo.py#L411-L431
- https://github.com/mistralai/mistral-vibe
- https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-remote-code-execution-via-git-post-checkout
Related changes
Linked by CVE identifierNo related changes are available here.