Vendor
mistralai
14 known vulnerabilities.
mistralai at a glance
- Last 12 months
- 14
- Critical · all time
- 6
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 3 | 0 |
| Oct 2026 | 3 | 0 |
| Sep 2026 | 7 | 6 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
14 results · Feed
-
High 8.8
Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with …
-
High 8.8
Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers
Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider._fetch…
-
High 8.8
Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContext…
-
High 8.8
Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and r…
-
High 8.8
Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. A…
-
High 8.8
Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in t…
-
High 8.8
Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell comma…
-
Critical 10.0
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through comm…
-
Critical 10.0
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using …
-
Critical 10.0
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using …
-
Critical 10.0
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using …
-
Critical 9.3
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or ove…
-
Critical 9.2
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspa…
-
High 8.8
Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --po…