CyberRota Analysis
AI-GeneratedMistral Vibe versions prior to 2.23.3 are vulnerable to a remote code execution flaw that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file. This vulnerability is triggered when the `vibe` tool invokes `git status --porcelain`, leading to potential exploitation with the victim's full privileges whenever a vibe command is executed within the compromised repository. Organizations using Mistral Vibe should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.