CVE-2026-122135: Mistral Vibe: RCE via repo-configured gpg.program

HIGH

Published November 4, 2026

CISO Take

Mistral Vibe, Mistral's AI coding agent, runs `git log` while collecting project context at session start, and a malicious repository can set `gpg.program` and `log.showSignature` so that git executes an attacker-supplied program before the user sees any trust prompt. Merely opening a crafted repository (CVSS 8.8, user interaction limited to cloning and launching the tool) gives the attacker code execution with the developer's privileges, which typically means access to source code, cloud credentials, API keys and CI tokens. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so the near-term mass-exploitation likelihood is low. However, the technique is trivial to weaponize, the package has 473 downstream dependents, and 15 other CVEs have been recorded in the same package, which signals a pattern of weak hardening. Upgrade to Mistral Vibe 3.0.3 or later, and until then avoid running Vibe inside untrusted or freshly cloned repositories.

Sources:NVDATLASGitHub AdvisoryVulnCheckgithub.com/mistralai/mistral-vibe

What is the risk?

High. The attack is network-delivered with low complexity, no privileges and only a single user action (cloning a repository and starting a session). Impact on confidentiality, integrity and availability is high because code runs as the developer before any trust prompt can intervene. Exploitation likelihood is moderate: there is no public exploit, no scanner template and no KEV listing, but the primitive (git config-driven program execution) is well understood and the CWE-829 class (inclusion of functionality from an untrusted control sphere) is easy to reproduce. Risk concentrates on developer workstations and CI runners that run the agent against third-party or unreviewed repositories. Package risk score is 32/100 and the project is actively maintained (last push 2026-10-30).

How does the attack unfold?

Initial Access

Attacker distributes a crafted repository with malicious gpg.program and log.showSignature settings plus a signed commit.

AML.T0011

Trigger

The victim opens the repository in Mistral Vibe, which runs git log during project context collection at session start.

AML.T0112.000

Execution

Git invokes the attacker's program as the gpg verifier before any trust prompt is shown.

AML.T0050

Impact

The attacker gains code execution on the developer machine and steals source code, credentials and tokens.

Initial Access

Attacker distributes a crafted repository with malicious gpg.program and log.showSignature settings plus a signed commit.

AML.T0011

Trigger

The victim opens the repository in Mistral Vibe, which runs git log during project context collection at session start.

AML.T0112.000

Execution

Git invokes the attacker's program as the gpg verifier before any trust prompt is shown.

AML.T0050

Impact

The attacker gains code execution on the developer machine and steals source code, credentials and tokens.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
773473 dependentsPushed 5d ago0% patchedFull package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mistral-vibe to 3.0.3 or later (fix commit 7bb48f2). 2) Until patched, do not launch Vibe in untrusted or freshly cloned repositories; inspect .git/config for gpg.program and log.showSignature entries first. 3) Run coding agents in disposable containers or VMs with no long-lived credentials and restricted egress. 4) Harden git globally where feasible, for example by checking repository-local configuration before running automated git commands. 5) Detection: alert on git spawning unexpected child processes (shells, curl, wget, interpreters) from agent sessions, and audit EDR telemetry for process trees rooted at the vibe CLI. 6) Inventory pip installs of mistral-vibe across endpoints and CI images.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkAML.T0010.001- AI Software AML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-122135?

Is CVE-2026-122135 actively exploited?

No confirmed active exploitation of CVE-2026-122135 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-122135?

1) Upgrade mistral-vibe to 3.0.3 or later (fix commit 7bb48f2). 2) Until patched, do not launch Vibe in untrusted or freshly cloned repositories; inspect `.git/config` for `gpg.program` and `log.showSignature` entries first. 3) Run coding agents in disposable containers or VMs with no long-lived credentials and restricted egress. 4) Harden git globally where feasible, for example by checking repository-local configuration before running automated git commands. 5) Detection: alert on `git` spawning unexpected child processes (shells, curl, wget, interpreters) from agent sessions, and audit EDR telemetry for process trees rooted at the vibe CLI. 6) Inventory pip installs of mistral-vibe across endpoints and CI images.

What systems are affected by CVE-2026-122135?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CI/CD pipelines.

What is the CVSS score for CVE-2026-122135?

CVE-2026-122135 has a CVSS v3.1 base score of 8.8 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsdeveloper workstationsCI/CD pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute the attacker's program at session start, before any trust prompt.

Exploitation Scenario

An attacker publishes a plausible repository, or submits a pull request branch or a contributor sample, containing a `.git/config` that sets `gpg.program` to a malicious script and `log.showSignature=true`, along with a signed commit. A developer clones it and starts Mistral Vibe to review the code. During session startup, Vibe's system prompt builder runs `git log` for project context, git invokes the attacker's program to verify the signature, and the payload runs before any trust prompt appears. The payload exfiltrates SSH keys, cloud credentials and API tokens, then establishes persistence on the workstation.

Weaknesses (CWE)

CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.