CVE-2026-116843: Mistral Vibe: RCE via git filter drivers in worktree

HIGH

Published October 27, 2026

CISO Take

Mistral Vibe before 3.0.3 executes attacker-defined git filter commands (smudge, clean, process) from a malicious repository's .git/config when launched with --worktree, because git worktree add runs before the trusted-folder check, so the safeguard meant to protect users is bypassed. The CVSS is 8.8 and the flaw needs only one user action: opening an untrusted repository, and commands run with the developer's full privileges, putting local credentials, API keys and source code at risk. It is not in CISA KEV, has no public exploit or Nuclei template and no EPSS score yet, but the pattern is simple to weaponize. The package has 467 downstream dependents and 12 other CVEs, which signals a recurring security debt in this AI coding-agent tooling. Upgrade to Mistral Vibe 3.0.3 or later, avoid --worktree on repositories you do not trust, and inventory developer workstations and CI runners that run Vibe.

Sources:NVDATLASGitHub (mistral-vibe issue, commit and release notes)vulncheck.comOpenSSF

What is the risk?

High. Exploitation is low complexity, needs no privileges and one user action (running Vibe with --worktree on an attacker-controlled repository). Impact covers confidentiality, integrity and availability at the user's privilege level. There is no KEV listing, public exploit or scanner template, and EPSS is not available, so current exploitation likelihood is unquantified. Risk is concentrated on developer workstations and automation that clone third-party repositories, where credentials and signing keys are typically present.

How does the attack unfold?

Initial Access

Attacker publishes a repository with malicious git filter drivers in .git/config and a .gitattributes file.

AML.T0010.001

User Execution

Victim clones the repository and starts Mistral Vibe with --worktree.

AML.T0011

Exploitation

git worktree add applies the filters and runs smudge, clean or process commands before the trusted-folder check.

AML.T0050

Impact

Attacker code runs with user privileges, exposing credentials, source code and the developer environment.

AML.T0112.000

Initial Access

Attacker publishes a repository with malicious git filter drivers in .git/config and a .gitattributes file.

AML.T0010.001

User Execution

Victim clones the repository and starts Mistral Vibe with --worktree.

AML.T0011

Exploitation

git worktree add applies the filters and runs smudge, clean or process commands before the trusted-folder check.

AML.T0050

Impact

Attacker code runs with user privileges, exposing credentials, source code and the developer environment.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
774467 dependentsPushed 8d ago0% patchedFull package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mistral-vibe to 3.0.3 or later (fix commit 7bb48f2). 2) Until patched, do not use --worktree on untrusted or freshly cloned repositories. 3) Review .git/config and .gitattributes in third-party repos for filter.*.smudge, clean and process entries before running agent tooling. 4) Run coding agents in isolated containers or VMs with minimal credentials and no ambient secrets. 5) Consider setting git config protections and scanning cloned repos for filter drivers in CI. 6) Detect by monitoring for unexpected child processes spawned by git under the vibe process, and rotate credentials on any host that ran an unpatched version against untrusted repositories.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and supply chain risk management

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-116843?

Is CVE-2026-116843 actively exploited?

No confirmed active exploitation of CVE-2026-116843 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116843?

1) Upgrade mistral-vibe to 3.0.3 or later (fix commit 7bb48f2). 2) Until patched, do not use --worktree on untrusted or freshly cloned repositories. 3) Review .git/config and .gitattributes in third-party repos for filter.*.smudge, clean and process entries before running agent tooling. 4) Run coding agents in isolated containers or VMs with minimal credentials and no ambient secrets. 5) Consider setting git config protections and scanning cloned repos for filter drivers in CI. 6) Detect by monitoring for unexpected child processes spawned by git under the vibe process, and rotate credentials on any host that ran an unpatched version against untrusted repositories.

What systems are affected by CVE-2026-116843?

This vulnerability affects the following AI/ML architecture patterns: AI coding agents, developer workstations, CI/CD pipelines, agent frameworks.

What is the CVSS score for CVE-2026-116843?

CVE-2026-116843 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

AI coding agentsdeveloper workstationsCI/CD pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.

Exploitation Scenario

An attacker publishes a repository, or a pull request branch, with a .git/config that defines a filter driver whose smudge command downloads and runs a payload, plus a .gitattributes file that applies the filter to common files. A developer clones it and starts Mistral Vibe with --worktree to have the agent review or fix code. Vibe calls git worktree add, which applies the filter and runs the attacker's command with the user's privileges before the trusted-folder check appears. The payload exfiltrates API keys and SSH keys and installs persistence, giving the attacker a foothold in the developer's environment and its connected cloud and source-control systems.

Weaknesses (CWE)

CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.