Description
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mistralai mistral-vibe
Default version status: unaffected
0 to < 2.25.5affected
pkg:pypi/mistral-vibeReferences
- https://github.com/mistralai/mistral-vibe/issues/996 ↗
- https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553 ↗
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5 ↗
- https://github.com/mistralai/mistral-vibe/blob/19b5b74faa78d0816b8d4d4c7d7543fc3520678c/vibe/core/git/repo.py#L411-L431 ↗
- https://github.com/mistralai/mistral-vibe ↗
- https://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-remote-code-execution-via-git-post-checkout ↗