CVE-2026-93993: Mistral Vibe RCE Vulnerability

CVE-2026-93993 Overview

CVE-2026-93993 is a remote code execution vulnerability in Mistral Vibe, Mistral AI's open-source coding assistant, affecting all versions prior to 2.25.5. The flaw resides in the worktree creation process, which executes Git hooks before performing trust validation on the repository. An attacker who convinces a user to open or clone a malicious repository can supply a crafted post-checkout hook that runs arbitrary shell commands under the privileges of the user running Vibe. The vulnerability is classified under CWE-829: Inclusion of Functionality from Untrusted Control Sphere.

Critical Impact
Attackers achieve arbitrary command execution on developer workstations when a victim opens an untrusted repository in Mistral Vibe, enabling credential theft, lateral movement, and supply chain compromise.

Affected Products

Mistral Vibe versions before 2.25.5
Mistral Vibe CLI distribution
Mistral Vibe Zed editor extension prior to 2.25.5

Discovery Timeline

2026-09-19 - CVE-2026-93993 published to the National Vulnerability Database
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-93993

Vulnerability Analysis

Mistral Vibe integrates Git worktree management to isolate agent sessions inside separate working directories. The worktree creation routine in vibe/core/git/repo.py invokes Git operations that trigger local hooks stored inside the repository's .git/hooks directory. Because trust validation runs after these hooks execute, a repository controlled by an attacker can ship a post-checkout script that Vibe silently runs during worktree setup.

The result is code execution before the user is prompted to trust the repository. Any shell command available to the user account running Vibe becomes reachable, including package installation, SSH key exfiltration, and modification of shell startup files. See the VulnCheck Advisory for Mistral Vibe for the coordinated technical writeup.

Root Cause

The root cause is an ordering defect: trust checks are performed only after Git operations that invoke repository-controlled hooks. The vulnerable logic sits in the worktree creation block referenced at vibe/core/git/repo.py lines 411-431. Because Git executes post-checkout, post-merge, and similar hooks automatically, any prompt for user consent afterward is meaningless. This is a classic instance of [CWE-829], loading executable content from an untrusted source into a trusted execution context.

Attack Vector

An attacker publishes a repository containing a malicious post-checkout hook. Delivery vectors include shared links, pull request references, issue attachments, or supply chain typosquats of popular projects. When the victim opens or clones the repository through Mistral Vibe, worktree creation triggers the hook and executes attacker-supplied commands. User interaction is required, but no additional privileges or authentication are needed.

The vulnerability is documented in the GitHub Issue Tracker for Mistral Vibe #996 and remediated in the v2.25.5 release.

text

 # Fragment from the security patch bumping the Zed extension version
 id = "mistral-vibe"
 name = "Mistral Vibe"
 description = "Mistral's open-source coding assistant"
-version = "2.25.4"
+version = "2.25.5"
 schema_version = 1
 authors = ["Mistral AI"]
 repository = "https://github.com/mistralai/mistral-vibe"

Source: GitHub Commit c069ffa

Detection Methods for CVE-2026-93993

Indicators of Compromise

Unexpected child processes spawned by the Mistral Vibe process, including sh, bash, python, or curl, shortly after a repository is opened.
Presence of executable scripts under .git/hooks/post-checkout, .git/hooks/post-merge, or .git/hooks/post-rewrite inside cloned repositories.
Outbound network connections from developer workstations to unfamiliar hosts immediately after repository checkout events.
Modifications to shell initialization files such as ~/.bashrc, ~/.zshrc, or ~/.ssh/authorized_keys around the time of a Vibe worktree operation.

Detection Strategies

Hunt for process-tree relationships where the Vibe binary is the parent of interpreter or network-utility processes.
Inventory installed Vibe versions across workstations and flag any release older than 2.25.5.
Correlate Git clone or checkout telemetry with subsequent file writes to sensitive user paths.

Monitoring Recommendations

Enable command-line logging on developer endpoints and centralize into an analytics platform for retrospective hunts.
Alert on writes to Git hook directories originating from workflows that download third-party repositories.
Monitor egress from developer workstations for connections to newly registered domains after repository operations.

How to Mitigate CVE-2026-93993

Immediate Actions Required

Upgrade Mistral Vibe to version 2.25.5 or later on all developer endpoints, including the Zed editor extension.
Audit recently opened repositories in Vibe for the presence of Git hooks and revoke any credentials that may have been exposed.
Restrict Mistral Vibe usage to repositories from trusted sources until patch deployment is verified.

Patch Information

Mistral AI released the fix in Mistral Vibe v2.25.5 via commit c069ffa1e12fb5f2487b489217c40ab97721d553. The patch reorders trust validation so untrusted repositories no longer trigger Git hooks during worktree creation. Source code for the affected component is available at the Mistral Vibe GitHub repository.

Workarounds

Set the Git configuration option core.hooksPath to a directory containing only vetted hooks, neutralizing repository-supplied hooks system-wide.
Clone untrusted repositories using git clone --no-checkout and inspect .git/hooks/ before opening the project in Vibe.
Run Mistral Vibe inside an isolated container or ephemeral virtual machine to contain any code executed by malicious hooks.

bash

# Neutralize repository-supplied Git hooks globally
mkdir -p ~/.git-safe-hooks
git config --global core.hooksPath ~/.git-safe-hooks

# Verify installed Mistral Vibe version meets the patched release
vibe --version   # must report 2.25.5 or newer