CVE-2026-93993: Mistral Vibe: RCE via git hooks run before trust check

HIGHPoC AVAILABLECISA: ATTEND

Published September 19, 2026

CISO Take

Mistral Vibe, a CLI coding agent, runs git hooks during worktree creation before it validates repository trust, so a malicious repo with a crafted post-checkout hook executes arbitrary shell commands as the user who launched Vibe. The CVSS is 8.8 and the bug is trivial to trigger once a developer opens an untrusted repository. A public PoC exists and CISA SSVC says ATTEND, but EPSS is low (0.77%, top 46%) and the CVE is not in KEV, so we have no evidence of active exploitation yet. Blast radius is moderate: the package has 462 downstream dependents and 9 other CVEs, which points to a recurring security debt. Upgrade to mistral-vibe 2.25.5 or later, and until then do not point Vibe at untrusted repositories on workstations that hold cloud, SSH or API credentials.

Sources:NVDEPSSATLASGitHub (mistral-vibe commit and release notes)vulncheck.com

What is the risk?

High. The attack is network-reachable (a repo clone), low complexity, needs no privileges and one user action (opening or cloning a repo in Vibe). Impact is full compromise of confidentiality, integrity and availability for the user context. A public PoC lowers the skill barrier, while the low EPSS and absence from KEV limit near-term likelihood. Developer workstations typically hold source code, cloud credentials, SSH keys and LLM API keys, which raises the real-world impact above the base score.

How does the attack unfold?

Initial Access

Attacker plants a crafted post-checkout git hook in a repository the victim is lured into opening with Vibe.

AML.T0011

Execution

Vibe creates a worktree and runs the hook before trust validation, executing attacker shell commands.

AML.T0050

Credential Access

Payload harvests SSH keys, cloud tokens and LLM API keys from the developer environment.

AML.T0055

Impact

Attacker gains full host control and can tamper with code or pivot into cloud and CI systems.

AML.T0112.000

Initial Access

Attacker plants a crafted post-checkout git hook in a repository the victim is lured into opening with Vibe.

AML.T0011

Execution

Vibe creates a worktree and runs the hook before trust validation, executing attacker shell commands.

AML.T0050

Credential Access

Payload harvests SSH keys, cloud tokens and LLM API keys from the developer environment.

AML.T0055

Impact

Attacker gains full host control and can tamper with code or pivot into cloud and CI systems.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
773473 dependentsPushed 4d ago0% patchedFull package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mistral-vibe to 2.25.5 or later (pip install -U mistral-vibe) and verify the installed version across developer fleets and CI images. 2) Until patched, avoid running Vibe on untrusted or unreviewed repositories; inspect .git/hooks and any hook configuration (core.hooksPath) before use. 3) Run agent tooling in isolated containers or VMs with no long-lived credentials. 4) Detection: monitor for shell processes spawned by the vibe process or git post-checkout executions, unexpected outbound connections from developer endpoints, and new or modified hook files in cloned repos. 5) Inventory pip packages via SBOM or EDR to find affected versions. 6) Rotate credentials on any machine that opened an untrusted repo with a vulnerable version.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkAML.T0010.001- AI Software AML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-93993?

Is CVE-2026-93993 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-93993, increasing the risk of exploitation.

How to fix CVE-2026-93993?

1) Upgrade mistral-vibe to 2.25.5 or later (pip install -U mistral-vibe) and verify the installed version across developer fleets and CI images. 2) Until patched, avoid running Vibe on untrusted or unreviewed repositories; inspect .git/hooks and any hook configuration (core.hooksPath) before use. 3) Run agent tooling in isolated containers or VMs with no long-lived credentials. 4) Detection: monitor for shell processes spawned by the vibe process or git post-checkout executions, unexpected outbound connections from developer endpoints, and new or modified hook files in cloned repos. 5) Inventory pip packages via SBOM or EDR to find affected versions. 6) Rotate credentials on any machine that opened an untrusted repo with a vulnerable version.

What systems are affected by CVE-2026-93993?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CI/CD pipelines.

What is the CVSS score for CVE-2026-93993?

CVE-2026-93993 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.77%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsdeveloper workstationsCI/CD pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Exploitation Scenario

An attacker publishes or contributes a repository, or a pull request branch, containing a crafted post-checkout hook that downloads and runs a reverse shell or credential stealer. A developer asks Mistral Vibe to work on that repo; Vibe creates a git worktree, which fires the hook before any trust validation. The payload runs as the developer, harvests SSH keys, cloud tokens and LLM API keys, and the attacker then uses them to push malicious commits or access cloud resources.

Weaknesses (CWE)

CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.