CVE-2026-67623

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mistralai/mistral-vibe/commit/68ff32e6a92e80a874c8153312f0aa8ae4955477
https://github.com/mistralai/mistral-vibe/issues/942
https://github.com/mistralai/mistral-vibe/pull/962
https://github.com/mistralai/mistral-vibe/pull/978
https://github.com/mistralai/mistral-vibe/releases/tag/v2.23.3
https://therealcoiffeur.com/c111011.html
https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-via-git-fsmonitor-hook
https://github.com/mistralai/mistral-vibe/issues/942

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Mistral Vibe anterior a la versión 2.23.3 contiene una vulnerabilidad de ejecución remota de código que permite a los atacantes ejecutar comandos arbitrarios incrustando un hook malicioso core.fsmonitor en el archivo .git/config de un repositorio, el cual se activa cuando vibe invoca git status --porcelain sin suprimir la ejecución del hook. Los atacantes pueden distribuir o crear un repositorio manipulado que contenga una entrada fsmonitor maliciosa para lograr la ejecución de comandos arbitrarios con los privilegios completos de la víctima cuando se ejecuta cualquier comando de vibe dentro de ese repositorio.

Information

Published : 2026-08-05 14:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-67623

Mitre link : CVE-2026-67623

CVE.ORG link : CVE-2026-67623

JSON object : View

Products Affected

No product.

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-67623", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67623", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T14:27:45.827252Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/mistralai/mistral-vibe", "vendor": "mistralai", "product": "mistral-vibe", "versions": [{"status": "affected", "version": "0", "lessThan": "2.23.3", "versionType": "semver"}], "packageURL": "pkg:github/mistralai/mistral-vibe", "defaultStatus": "affected"}]}], "published": "2026-08-05T14:17:10.047", "references": [{"url": "https://github.com/mistralai/mistral-vibe/commit/68ff32e6a92e80a874c8153312f0aa8ae4955477", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mistralai/mistral-vibe/issues/942", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mistralai/mistral-vibe/pull/962", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mistralai/mistral-vibe/pull/978", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mistralai/mistral-vibe/releases/tag/v2.23.3", "source": "disclosure@vulncheck.com"}, {"url": "https://therealcoiffeur.com/c111011.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-via-git-fsmonitor-hook", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mistralai/mistral-vibe/issues/942", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository."}, {"lang": "es", "value": "Mistral Vibe anterior a la versi\u00f3n 2.23.3 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que permite a los atacantes ejecutar comandos arbitrarios incrustando un hook malicioso core.fsmonitor en el archivo .git/config de un repositorio, el cual se activa cuando vibe invoca git status --porcelain sin suprimir la ejecuci\u00f3n del hook. Los atacantes pueden distribuir o crear un repositorio manipulado que contenga una entrada fsmonitor maliciosa para lograr la ejecuci\u00f3n de comandos arbitrarios con los privilegios completos de la v\u00edctima cuando se ejecuta cualquier comando de vibe dentro de ese repositorio."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}