Back exploit-intel.com

CVE-2026-93993: Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout [HIGH] CVSS 8.6 Exploit Intelligence - Recent CVEs / 6h Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

exploit-intel.com • September 20, 2026

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Affected products and versions

Default status: unaffected

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-93993: Remote Code Execution Vulnerability in Mistral Vibe A remote code execution vulnerability, CVE-2026-93993, has been identified in Mistral Vibe versions prior to 2.25.5. This flaw allows attackers to execute arbitrary shell commands by supplying a malicious repository with a crafted post-checkout hook before trust validation occurs. The vulnerability affects users running Mistral Vibe, potentially leading to full system compromise depending on user privileges. There is currently no evidence of public proof-of-concept or exploitation in the wild. Users are advised to upgrade to version 2.25.5 or later to mitigate the risk. Until a patch can be applied, it is recommended to avoid cloning or creating worktrees from untrusted repositories. The CVSS score for this vulnerability is 8.6, indicating a high severity level. 3 sources 57

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)