- The NIST NVD says Mistral Vibe before 2.25.7 can run an attacker's commands when a user opens a crafted Git repository, before any trust prompt.
- A trust prompt protects only if nothing runs ahead of it. Here, a routine Git status check at startup is the trigger.
- Find any copies of the tool below 2.25.7, update them, and ask vendors whether their tools prompt for trust before touching a folder.
A warning is only useful if it comes first
A trust prompt asks one question: do you trust this folder? It works only if nothing happens before you answer. CVE-2026-122134 describes a case where, according to the NIST National Vulnerability Database (NVD), something did.
What the record says
The NVD record was published on November 4, 2026. It says Mistral Vibe versions before 2.25.7 contain a remote code execution flaw. Attackers can run commands by configuring malicious Git "clean" or "process" filter drivers in a repository.
The trigger is ordinary. When a user opens a crafted repository, a function called ProjectContextProvider._fetch_git_status runs the command git status at startup. That invokes the filters. According to the record, the commands then run with the user's privileges, before any trust prompt.
The record does not describe what the product does beyond this. It does not report attacks in the wild.
How the attack works
Git filter drivers are programs that Git can call to transform files as it handles them. A repository can name which program to call. That is a normal feature, and it turns any repository into something that can carry instructions, not just files.
Here the entry point was a status check. The name sounds like reading. But when the thing being read is controlled by an attacker, a command that looks harmless can start another program.
Older software learned a version of this lesson. Email clients once ran into trouble when a preview pane processed a message before the reader chose to open it. The risk sat in the processing that came first, not in the click.
This is the idea worth holding onto. The prompt was not bypassed by cleverness. The tool did its work ahead of the prompt. A control that arrives after the risky step is a courtesy, not a safeguard.
How serious is it
VulnCheck, through [email protected], scored the flaw. Under CVSS 3.1 it rates 8.8, labelled HIGH. Under CVSS 4.0 it rates 8.6, also HIGH.
The vector strings say the attack comes over a network and needs low complexity and no privileges. They also say the user must take an action. In plain words, a person has to open the crafted repository.
That requirement matters. It also describes a routine task for many teams: opening code from outside, such as a contractor's work, a fork or a sample project.
Commands run with the user's privileges. So the reach depends on what that user can access. For a staff member with cloud keys or source code access, that can be a lot.
What leaders should ask
Start with inventory. The NVD lists version 2.25.7 as the release that addresses the flaw. Ask your teams whether anyone runs Mistral Vibe, and which version. The record does not say what the tool does, so ask them to explain how it is used. Anything earlier than 2.25.7 is in scope.
Then widen the question beyond this one tool. Ask which tools in your company open repositories from outside. For each, ask whether it requests trust before it touches the folder, or after.
Ask vendors the same thing in writing. A trust prompt is a promise about order. If the order is wrong, the prompt protects less than it appears to.
Finally, ask what a developer's account can reach. If one opened repository can run commands as that person, then limiting that person's access limits the damage. The lesson here is simple: check what runs before the warning, not just what the warning says.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: NIST NVD.
