CVE-2026-67623

8.8 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-06

AI risk analysis

Summary: Mistral Vibe before 2.23.3 allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, posing a significant risk to system security.
Exploitability: Exploitation requires attackers to distribute or create a crafted repository and run any vibe command within it, making it moderately hard to exploit.
Blast radius: If exploited, attackers can achieve arbitrary command execution with the victim's full privileges, leading to potential full system compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Mistral Vibe 2.23.3 or later.

rcegitremote-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-829

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.