CVE-2026-116843

Mistral Vibe worktree setup can execute repository filter commands before trust checks

Mistral AI · Mistral Vibe

First documented disclosure · Review checkpoint

Summary

Worktree creation could run attacker-controlled Git filter commands before the trusted-folder check.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Git checkout applied attribute filters using commands defined in the repository’s local Git configuration.

Conditions required

Starting affected Vibe with --worktree in an untrusted repository whose local Git configuration contains malicious filters.

Potential impact

Command execution with the user’s privileges.

Affected versions and configurations

Before 3.0.3.

Fix and mitigation status

3.0.3.

Practical next steps

Update and treat repository-local Git configuration as executable authority before worktree creation.

Operating lesson

Perform trust checks before setup actions that can invoke repository-defined commands.

Evidence and limits

The August 12 public issue predates October 27 CVE publication. A normal remote clone does not itself transfer .git/config; the required attacker-controlled local repository configuration must be preserved in the threat model.

Sources