High 8.8Published Oct 26, 2026

CVE-2026-116843Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

Updated under an hour ago (Oct 30, 2026, 5:30 AM ET)

Does this affect you?

It affects mistralai mistral-vibe. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.43%, higher than 38% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for mistralai mistral-vibe Exploited in the last 30 days

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-829
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.43% (percentile 38)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

mistralai mistral-vibe mistralai:mistral_vibe (from the name)	before 3.0.3	CNA record

References

References

https://github.com/mistralai/mistral-vibe/issues/997	issue-tracking
https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00	patch
https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3	release-notes
https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317	technical-description
https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.