Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck

CVE-2026-67623Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

High 8.8

In plain English

A high-severity security flaw in mistral-vibe from mistralai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.1%top 35.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

Affected products (as reported)

Vendor	Product	Versions
mistralai	mistral-vibe	0 – before 2.23.3

Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Researcher Disclosure technical-description, exploit
Release Notes release-notes
Pull Request (1) issue-tracking
Pull Request (2) issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-via-git-fsmonitor-hook third-party-advisory