CVE-2026-122134: Mistral Vibe: Git filter RCE on repo open

HIGH

Published November 4, 2026

CISO Take

Mistral Vibe versions before 2.25.7 run `git status` at startup, which invokes attacker-defined Git clean or process filter drivers from a crafted repository and executes arbitrary commands with the developer's privileges before any trust prompt appears. The CVSS is 8.8 and the only precondition is that a user opens a malicious repository, a routine action for developers who clone third-party code and use AI coding agents. Exploitation signals are currently low: EPSS is not yet available, there is no KEV listing, no public exploit and no Nuclei template. The package has 473 downstream dependents and 15 other CVEs, which points to a recurring weakness pattern. Developer workstations typically hold SSH keys, cloud credentials and source code, so the impact goes beyond the single machine. Upgrade to 2.25.7 or later, and until then avoid opening untrusted repositories with Vibe.

Sources:NVDATLASGitHub Advisoryvulncheck.comgithub.com/mistralai

What is the risk?

High. Exploitation is simple, because it needs only a repository containing a malicious .git/config or .gitattributes filter definition and a user who opens it. The trust prompt is bypassed because the command runs before it is shown, so the safeguard meant to protect users does not apply. There is no known in-the-wild exploitation, public PoC or EPSS signal yet, but the technique (Git filter drivers) is well documented and trivial to weaponize. Confidentiality, integrity and availability impact are all high, with code running as the user. The affected version range and the patched version in structured data are not populated, but the vendor release notes identify 2.25.7 as the fix.

How does the attack unfold?

Initial Access

The attacker distributes a crafted repository with malicious Git clean or process filter drivers.

AML.T0011

Trigger

The victim opens the repository in Mistral Vibe, which runs git status at startup via _fetch_git_status before any trust prompt.

AML.T0112.000

Execution

Git invokes the filter driver and runs attacker commands with the user's privileges.

AML.T0050

Impact

The attacker steals credentials and source code and may persist or tamper with code on the developer machine.

AML.T0055

Initial Access

The attacker distributes a crafted repository with malicious Git clean or process filter drivers.

AML.T0011

Trigger

The victim opens the repository in Mistral Vibe, which runs git status at startup via _fetch_git_status before any trust prompt.

AML.T0112.000

Execution

Git invokes the filter driver and runs attacker commands with the user's privileges.

AML.T0050

Impact

The attacker steals credentials and source code and may persist or tamper with code on the developer machine.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
773473 dependentsPushed 5d ago0% patchedFull package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mistral-vibe to 2.25.7 or later (pip install --upgrade mistral-vibe) and inventory installs on developer machines and CI images. 2) Until patched, do not launch Vibe inside cloned or downloaded repositories from untrusted sources; review .git/config and .gitattributes for filter.*.clean, filter.*.process and related settings first. 3) Consider setting safe Git configuration for untrusted checkouts and running agents in isolated containers or VMs without access to production credentials. 4) Detect by monitoring for unexpected child processes spawned by git invoked from the vibe process, and for repositories with unusual filter driver definitions. 5) Rotate credentials on any machine where Vibe opened an untrusted repository before patching.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkAML.T0010.001- AI Software AML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and mechanisms for disengagement

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-122134?

Is CVE-2026-122134 actively exploited?

No confirmed active exploitation of CVE-2026-122134 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-122134?

1) Upgrade mistral-vibe to 2.25.7 or later (pip install --upgrade mistral-vibe) and inventory installs on developer machines and CI images. 2) Until patched, do not launch Vibe inside cloned or downloaded repositories from untrusted sources; review .git/config and .gitattributes for filter.*.clean, filter.*.process and related settings first. 3) Consider setting safe Git configuration for untrusted checkouts and running agents in isolated containers or VMs without access to production credentials. 4) Detect by monitoring for unexpected child processes spawned by git invoked from the vibe process, and for repositories with unusual filter driver definitions. 5) Rotate credentials on any machine where Vibe opened an untrusted repository before patching.

What systems are affected by CVE-2026-122134?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, AI coding assistants, Developer workstations, CI/CD pipelines.

What is the CVSS score for CVE-2026-122134?

CVE-2026-122134 has a CVSS v3.1 base score of 8.8 (HIGH).

What is the AI security impact?

Affected AI Architectures

Agent frameworksAI coding assistantsDeveloper workstationsCI/CD pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch_git_status runs git status at startup, invoking the filters and executing commands with user privileges before any trust prompt.

Exploitation Scenario

An attacker publishes a repository, or submits a pull request branch, that includes a .gitattributes file assigning a custom filter and a Git configuration defining a clean or process filter command that downloads and runs a payload. A developer clones it and launches Mistral Vibe in the directory. At startup ProjectContextProvider._fetch_git_status runs git status, which triggers the filter and executes the attacker's command with the developer's privileges before the trust prompt is displayed. The payload exfiltrates SSH keys, cloud credentials and LLM API keys, and can establish persistence or modify local code.

Weaknesses (CWE)

CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.