CVE-2026-67623

8.8 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-06

AI risk analysis

Summary: Mistral Vibe before 2.23.3 allows attackers to execute arbitrary commands via a malicious .git/config file, posing a significant security risk.
Exploitability: Exploitation requires attackers to distribute or create a crafted repository; moderate difficulty due to the need for repository access.
Blast radius: If exploited, this vulnerability could lead to full system compromise with the victim's privileges across all affected repositories.
Prioritized remediation: Update to Mistral Vibe version 2.23.3 or later immediately to mitigate the risk.

rcegitrepositoryupdate

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-829

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.