Vulnerability in mistralai mistral-vibe

[ Description ]Official description

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/mistralai/mistral-vibe
• github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py
• github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py
• github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md
• github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
• github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
• www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-on-windows-untrusted-search-pat…