AI Threat AlertCVE-2026-122133: Mistral Vibe: untrusted git.exe path allows RCE on Windows
HIGHMistral Vibe, Mistral's AI coding agent CLI, before 2.25.5 on Windows resolves git.exe from the repository root, so opening a booby-trapped repository runs attacker code at session start, before any trust prompt appears. The CVSS is 8.8 and the only user action required is opening a crafted repo, which developers do routinely with cloned or shared projects. Risk is moderated by the Windows-only scope, no public exploit or Nuclei template, no KEV listing, and no EPSS score yet, but exploitation is trivial once an attacker can get a repository in front of a developer. The package has 473 downstream dependents and 15 other CVEs, which points to a recurring security debt in the project. Upgrade to 2.25.5 or later, and until then avoid opening untrusted repositories with Vibe on Windows and hunt for unexpected git.exe files inside repository roots.
What is the risk?
High. Exploitation is low complexity, needs no privileges and only one user action (opening a repository). Code runs with the developer's privileges before the trust prompt, defeating the main control. Exposure is limited to Windows hosts running Mistral Vibe below 2.25.5. No known public exploit, KEV listing or EPSS data at publication, so near-term mass exploitation is unlikely but targeted attacks on developers are realistic. Developer workstations commonly hold source code, cloud credentials, API keys and SSH keys, which raises impact.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Mistral AI | pip | — | No patch |
Do you use Mistral AI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade mistral-vibe to 2.25.5 or later (pip install -U mistral-vibe).
Until patched, do not open untrusted or newly cloned repositories with Vibe on Windows; use a sandbox or VM for review.
Set NoDefaultCurrentDirectoryInExePath=1 in the environment as a defense-in-depth measure for Windows process search.
Detect: scan repository roots for git.exe or other unexpected executables, and alert on git.exe processes spawned from non-standard paths (EDR rule on the image path not matching Git for Windows install directories) with parent python or vibe.
Inventory installed mistral-vibe versions across developer endpoints.
Rotate API keys and credentials on any host where a suspicious repo was opened.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-122133?
Mistral Vibe, Mistral's AI coding agent CLI, before 2.25.5 on Windows resolves git.exe from the repository root, so opening a booby-trapped repository runs attacker code at session start, before any trust prompt appears. The CVSS is 8.8 and the only user action required is opening a crafted repo, which developers do routinely with cloned or shared projects. Risk is moderated by the Windows-only scope, no public exploit or Nuclei template, no KEV listing, and no EPSS score yet, but exploitation is trivial once an attacker can get a repository in front of a developer. The package has 473 downstream dependents and 15 other CVEs, which points to a recurring security debt in the project. Upgrade to 2.25.5 or later, and until then avoid opening untrusted repositories with Vibe on Windows and hunt for unexpected git.exe files inside repository roots.
Is CVE-2026-122133 actively exploited?
No confirmed active exploitation of CVE-2026-122133 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-122133?
1. Upgrade mistral-vibe to 2.25.5 or later (pip install -U mistral-vibe). 2. Until patched, do not open untrusted or newly cloned repositories with Vibe on Windows; use a sandbox or VM for review. 3. Set NoDefaultCurrentDirectoryInExePath=1 in the environment as a defense-in-depth measure for Windows process search. 4. Detect: scan repository roots for git.exe or other unexpected executables, and alert on git.exe processes spawned from non-standard paths (EDR rule on the image path not matching Git for Windows install directories) with parent python or vibe. 5. Inventory installed mistral-vibe versions across developer endpoints. 6. Rotate API keys and credentials on any host where a suspicious repo was opened.
What systems are affected by CVE-2026-122133?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CLI-based LLM agents.
What is the CVSS score for CVE-2026-122133?
CVE-2026-122133 has a CVSS v3.1 base score of 8.8 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0011User ExecutionAML.T0050Command and Scripting InterpreterAML.T0112.000Local AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
Exploitation Scenario
An attacker publishes or sends a repository (for example a fake open source project, a pull request branch, or a take-home coding challenge) that contains a malicious git.exe at its root. A developer on Windows clones it and launches Mistral Vibe in that directory. At session start SessionLogger and ProjectContextProvider run git, Windows resolves the binary from the current directory, and the payload executes before any trust prompt. The attacker then steals environment variables, LLM API keys, cloud credentials and SSH keys, and can plant backdoors in the developer's other repositories.
Weaknesses (CWE)
CWE-427 — Uncontrolled Search Path Element: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
- [Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
- [Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- github.com/mistralai/mistral-vibeproduct
- github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.pytechnical-description
- github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.pytechnical-description
- github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.mdrelease-notes
- github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553patch
- github.com/mistralai/mistral-vibe/releases/tag/v2.25.5release-notes
- vulncheck.com/advisories/mistral-vibe-before-2.25.5-on-windows-untrusted-search-path-rce-via-git-exethird-party-advisory
Timeline
Related Vulnerabilities
GHSA-wx9m-wx4f-4cmg9.6mistralai 2.4.6: supply chain dropper executes on import
Same package: mistralaiCVE-2026-1094298.8Mistral Vibe: bash gate bypass allows silent RCE
Same package: mistralaiCVE-2026-939938.8Mistral Vibe: RCE via git hooks run before trust check
Same package: mistralaiCVE-2026-676238.8Mistral Vibe: RCE via malicious git fsmonitor hook
Same package: mistralaiCVE-2026-1094288.8Mistral Vibe: bash parsing bypass allows hidden commands
Same package: mistralai