Skip to content
Remote Code Execution Vulnerability in Mistral Vibe Disclosed

Remote Code Execution Vulnerability in Mistral Vibe Disclosed

First seen 5 Nov 2026, 02:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 02:50 UTC
  • •CVE-2026-122135 allows remote code execution in Mistral Vibe versions < 3.0.3.
  • •Attackers exploit the flaw by manipulating repository settings requiring user interaction.
  • •Immediate patching is recommended, especially for developers using untrusted repositories.

Mistral Vibe versions prior to 3.0.3 contain a remote code execution vulnerability identified as CVE-2026-122135, published on November 4, 2026. This flaw allows attackers to execute commands by manipulating the gpg.program setting in repository configurations during project context collection. The vulnerability requires user interaction to exploit, as an attacker must persuade a developer to open a crafted repository. The risk is particularly high for developers working with untrusted or externally contributed repositories, as successful exploitation could expose sensitive source code and credentials. Currently, there is no confirmed, but the vulnerability is deemed high risk with a CVSS score of 8.6. Developers are advised to upgrade to the fixed version and avoid opening untrusted repositories until a patch is applied. The urgency of the situation is still being assessed due to the lack of further exploitation data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-04
CVE-2026-122135 published
Mistral Vibe vulnerability disclosed, allowing remote code execution via manipulated gpg.program settings.
Sploitus
2026-11-05
CVE-2026-122135 alert issued
Redpacketsecurity issues an alert regarding the high-risk vulnerability in Mistral Vibe.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-122135 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions are affected?
Mistral Vibe versions prior to 3.0.3 are affected by this vulnerability.
Is there any active exploitation reported?
Currently, there is no confirmed active exploitation of this vulnerability.
What should developers do to protect themselves?
Developers should upgrade to Mistral Vibe 3.0.3 or later and avoid opening untrusted repositories.