CVE-2026-67623: Mistral Vibe RCE Vulnerability

CVE-2026-67623 Overview

CVE-2026-67623 is a remote code execution vulnerability in Mistral Vibe versions prior to 2.23.3. Mistral Vibe is Mistral AI's open-source command-line coding assistant. The flaw allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file. When a user runs any vibe command inside a crafted repository, Vibe invokes git status --porcelain without suppressing hook execution. Git then triggers the attacker-controlled fsmonitor binary with the victim's full privileges. The issue is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact

Arbitrary command execution with the victim's full user privileges triggered simply by running any vibe command inside a repository containing a malicious .git/config entry.

Affected Products

• Mistral Vibe versions before 2.23.3
• Mistral Vibe CLI coding agent (mistral-vibe Python package)
• Mistral Vibe Zed editor extension (distribution/zed/extension.toml)

Discovery Timeline

• 2026-08-05 - CVE-2026-67623 published to NVD
• 2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-67623

Vulnerability Analysis

Mistral Vibe uses Git internally to inspect repository state. Specifically, it invokes git status --porcelain to enumerate changed files before delegating to its coding agent. Git supports a core.fsmonitor configuration key that references an external program used to accelerate file-status queries. When core.fsmonitor is set to an arbitrary command in .git/config, Git executes that command each time a status-related operation runs.

Vibe does not suppress hook or fsmonitor execution when invoking Git. It also does not enforce GIT_OPTIONAL_LOCKS=0, -c core.fsmonitor=, or a safe-directory check before running Git subcommands. Any repository clone or checkout that carries a poisoned .git/config therefore turns any subsequent vibe invocation into an execution primitive for the attacker.

Root Cause

The root cause is unsafe trust of repository-controlled Git configuration. .git/config is a per-repository file that travels with the working copy on disk and can be modified by anyone who controls the repository contents. Vibe treats every repository as trusted context and shells out to Git without overriding hook-executing configuration keys.

Attack Vector

An attacker distributes a repository, either directly or through a public host, that contains a .git/config entry setting core.fsmonitor to an arbitrary command. Alternatively, an attacker with write access to an existing repository on disk can modify that key. When the victim opens the repository and runs any vibe command, Git executes the attacker's payload under the victim's account. Exploitation requires user interaction (running a vibe command inside the repository) but no additional privileges.

# Illustrative malicious .git/config entry (do not use)
[core]
    fsmonitor = /tmp/payload.sh

For patch verification, the fix ships in the version bumps below.

 id = "mistral-vibe"
 name = "Mistral Vibe"
 description = "Mistral's open-source coding assistant"
-version = "2.23.2"
+version = "2.23.3"
 schema_version = 1
 authors = ["Mistral AI"]
 repository = "https://github.com/mistralai/mistral-vibe"

Source: GitHub commit 68ff32e

 [project]
 name = "mistral-vibe"
-version = "2.23.2"
+version = "2.23.3"
 description = "Minimal CLI coding agent by Mistral"
 readme = "README.md"
 requires-python = ">=3.12"

Source: GitHub commit 68ff32e

Detection Methods for CVE-2026-67623

Indicators of Compromise

• Presence of a core.fsmonitor key in .git/config pointing to a script, binary, or shell one-liner rather than an empty value or a known tool such as rs-git-fsmonitor or watchman.
• Child processes spawned by git, git-status, or vibe that do not match expected developer tooling.
• Unexpected outbound network connections initiated shortly after a vibe command is invoked in a newly cloned repository.
• Modifications to .git/config, .git/hooks/, or .git/info/ immediately after a git clone operation.

Detection Strategies

• Scan developer workstations and build agents for repositories where .git/config sets core.fsmonitor and alert on non-allowlisted values.
• Correlate process telemetry to flag git or vibe as the parent of shells (bash, sh, pwsh), scripting interpreters, or unusual binaries under /tmp and user profile paths.
• Hunt for installed Mistral Vibe versions below 2.23.3 via pip show mistral-vibe output or the Zed extension manifest.
• Baseline expected fsmonitor binaries per team and treat any deviation as suspicious.

Monitoring Recommendations

• Enable command-line logging on developer endpoints and ingest process ancestry into a central data lake.
• Monitor for git config --get core.fsmonitor and git config core.fsmonitor invocations that return non-empty results.
• Track cloning activity from untrusted hosts and correlate with subsequent vibe executions inside those directories.

How to Mitigate CVE-2026-67623

Immediate Actions Required

• Upgrade Mistral Vibe to version 2.23.3 or later on all developer machines, CI runners, and container images.
• Audit existing local repositories for core.fsmonitor entries and remove any values that were not set intentionally.
• Instruct developers to avoid running vibe inside repositories cloned from untrusted sources until an audit is complete.
• Review process telemetry from the last 90 days for suspicious children of git or vibe on machines running vulnerable versions.

Patch Information

Mistral AI released the fix in Mistral Vibe v2.23.3 via pull requests #962 and #978. Additional context is available in the VulnCheck advisory and the upstream issue #942. Users can upgrade with pip install --upgrade mistral-vibe or by updating the Zed extension manifest to version 2.23.3.

Workarounds

• Set GIT_OPTIONAL_LOCKS=0 and export GIT_CONFIG_GLOBAL to a controlled file that disables core.fsmonitor before invoking vibe.
• Run git config --global --unset core.fsmonitor and use git config --global --add safe.directory policies to constrain which repositories Git will operate on.
• Restrict developer accounts from running Vibe against untrusted clones by wrapping vibe in a shell function that first inspects .git/config for hook-executing keys.
• Enforce use of ephemeral development containers so that any exploitation is contained to a disposable environment.

# Configuration example: neutralize core.fsmonitor before running vibe
git config --global --unset core.fsmonitor 2>/dev/null || true
export GIT_OPTIONAL_LOCKS=0

# Refuse to run vibe if the current repo declares a core.fsmonitor value
if git config --local --get core.fsmonitor >/dev/null 2>&1; then
    echo "Refusing to run: core.fsmonitor is set in .git/config" >&2
    exit 1
fi

vibe "$@"