Description
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mistralai | mistral-vibe | < 2.25.5 | 2.25.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mistral-vibe | 2.25.8-1.1 | openSUSE-SU-2026:11900-1 |
Advisories 1
- openSUSE-SU-2026:11900-1 mistral-vibe-2.25.8-1.1 on GA media SUSE / openSUSE Security Updates · Sep 29, 2026
References
- GitHub Issue #996 issue-tracking
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553 patch
- mistral-vibe v2.25.5 Release Notes release-notes
- add_worktree at v2.25.4 technical-description
- https://github.com/mistralai/mistral-vibe product
- VulnCheck Advisory: Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout third-party-advisory