CVE-2026-67623: Mistral AI RCE — HIGH

CISO Take

Mistral Vibe, an AI coding CLI, runs git status --porcelain without disabling git hook execution, so a repository containing a malicious core.fsmonitor entry in its .git/config executes arbitrary attacker commands the moment a victim opens or runs any vibe command inside it. With a CVSS of 8.8, 464 downstream dependents, and a public proof-of-concept already circulating, any developer who clones an untrusted or compromised repository and touches it with Vibe risks full command execution under their own privileges, including exposure of CI credentials, cloud tokens, and source code. The flaw isn't in CISA's KEV list and CISA's own SSVC assessment rates it TRACK, with EPSS sitting at only the 58th percentile, so treat this as a supply-chain risk to close quickly rather than an active incident. Patch to Mistral Vibe 2.23.3 or later immediately, and until fully rolled out, treat any repository cloned from outside your organization as untrusted before opening it with Vibe. Detection teams should watch for unexpected child processes spawned by vibe or git invocations and audit .git/config files in newly cloned repositories for unauthorized fsmonitor hook entries.

Sources: NVD EPSS CISA KEV GitHub Advisory ATLAS

What is the risk?

High risk despite the absence of confirmed in-the-wild exploitation. The vulnerability requires only minimal user interaction (opening or running a command inside a malicious repository), has low attack complexity, needs no privileges, and grants full confidentiality, integrity, and availability impact once triggered (CVSS 8.8). A public technical write-up and exploit code already exist, which materially lowers the bar for opportunistic abuse even though CISA's SSVC decision is TRACK and EPSS remains moderate (58th percentile). The real-world risk driver is exposure: developers routinely clone third-party or open-source repositories, and any one of them can be weaponized to silently compromise a workstation or CI runner running Mistral Vibe.

How does the attack unfold?

Stage malicious repository

Attacker creates or compromises a git repository and inserts a malicious core.fsmonitor entry into its .git/config.

AML.T0079

Lure victim to clone/open repo

Victim clones the repository and opens it with Mistral Vibe as part of normal development workflow.

AML.T0011

Trigger hook execution

Vibe internally runs git status --porcelain without disabling hooks, causing git to execute the attacker-controlled fsmonitor hook.

AML.T0050

Arbitrary command execution

The attacker's commands run with the victim's full privileges, enabling credential theft, persistence, or further compromise.

Stage malicious repository

Attacker creates or compromises a git repository and inserts a malicious core.fsmonitor entry into its .git/config.

AML.T0079

Lure victim to clone/open repo

Victim clones the repository and opens it with Mistral Vibe as part of normal development workflow.

AML.T0011

Trigger hook execution

Vibe internally runs git status --porcelain without disabling hooks, causing git to execute the attacker-controlled fsmonitor hook.

AML.T0050

Arbitrary command execution

The attacker's commands run with the victim's full privileges, enabling credential theft, persistence, or further compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
767 478 dependents Pushed 8d ago 0% patched Full package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Mistral Vibe to version 2.23.3 or later immediately, prioritizing developer workstations and any CI/CD runners that invoke vibe against externally sourced repositories. Until upgraded, avoid running any vibe command inside repositories of unknown or unverified provenance, and inspect .git/config files for unexpected core.fsmonitor entries before opening a cloned repo with Vibe. For fleet-wide detection, monitor for anomalous child processes spawned from git or vibe invocations and flag repositories where .git/config has been modified outside normal git operations. Where feasible, run Vibe against untrusted repositories inside a sandboxed or ephemeral environment with no access to long-lived credentials.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent AML.T0010.005 - AI Agent Tool AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter AML.T0079 - Stage Capabilities

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03:2025 - Supply Chain

Frequently Asked Questions

What is CVE-2026-67623?

Mistral Vibe, an AI coding CLI, runs git status --porcelain without disabling git hook execution, so a repository containing a malicious core.fsmonitor entry in its .git/config executes arbitrary attacker commands the moment a victim opens or runs any vibe command inside it. With a CVSS of 8.8, 464 downstream dependents, and a public proof-of-concept already circulating, any developer who clones an untrusted or compromised repository and touches it with Vibe risks full command execution under their own privileges, including exposure of CI credentials, cloud tokens, and source code. The flaw isn't in CISA's KEV list and CISA's own SSVC assessment rates it TRACK, with EPSS sitting at only the 58th percentile, so treat this as a supply-chain risk to close quickly rather than an active incident. Patch to Mistral Vibe 2.23.3 or later immediately, and until fully rolled out, treat any repository cloned from outside your organization as untrusted before opening it with Vibe. Detection teams should watch for unexpected child processes spawned by vibe or git invocations and audit .git/config files in newly cloned repositories for unauthorized fsmonitor hook entries.

Is CVE-2026-67623 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-67623, increasing the risk of exploitation.

How to fix CVE-2026-67623?

Upgrade Mistral Vibe to version 2.23.3 or later immediately, prioritizing developer workstations and any CI/CD runners that invoke vibe against externally sourced repositories. Until upgraded, avoid running any vibe command inside repositories of unknown or unverified provenance, and inspect .git/config files for unexpected core.fsmonitor entries before opening a cloned repo with Vibe. For fleet-wide detection, monitor for anomalous child processes spawned from git or vibe invocations and flag repositories where .git/config has been modified outside normal git operations. Where feasible, run Vibe against untrusted repositories inside a sandboxed or ephemeral environment with no access to long-lived credentials.

What systems are affected by CVE-2026-67623?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants / developer CLI tools, CI/CD pipelines invoking AI coding tools.

What is the CVSS score for CVE-2026-67623?

CVE-2026-67623 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistants / developer CLI toolsCI/CD pipelines invoking AI coding tools

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

AML.T0079 Stage Capabilities

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

Exploitation Scenario

An attacker publishes or contributes to a seemingly legitimate open-source repository (or compromises an existing one) and inserts a malicious core.fsmonitor hook entry into its .git/config. A developer, drawn in by the repository's apparent usefulness or as part of routine dependency review, clones it and opens it with Mistral Vibe to explore or work on the code. The first time Vibe internally calls git status --porcelain without suppressing hook execution, git invokes the attacker-controlled fsmonitor hook, executing arbitrary commands with the developer's full privileges — potentially exfiltrating SSH keys, cloud credentials, or source code, or establishing further persistence on the machine.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.