A separate Vibe startup path ran git status to collect repository context. If the local Git configuration selected a malicious clean or process filter, the Git command could execute that helper before the user approved the project. Ordinary git clone does not reproduce arbitrary .git/config, so delivery of effective local filter configuration is an…
Inspect the ClaimsCase · DiggingBeagle record
Mistral Vibe could trigger Git filter code while inspecting an untrusted project
Running git status under attacker-effective filter configuration reached executable helpers before Safe Mode approval.
Public disclosure: Nov 4, 2026
Scope
Coding-agent initialization on prepared local repositories with the stated Git configuration or executable-search preconditions.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
A Git filter executed by pretrust git status requires effective malicious local Git config; ordinary cloning does not automatically install it. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MISTRAL-VIBE-GIT-FILTER-01 · Vibe pre-trust git status ran configured Git filters
At a glance
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Read the implicationsOrdinary git clone does not reproduce arbitrary .git/config, so delivery of effective local filter configuration is an essential precondition. The fix in 2.25.7 is distinct from the earlier executable-search repair.
Limits and uncertaintyFull account
A separate Vibe startup path ran git status to collect repository context. If the local Git configuration selected a malicious clean or process filter, the Git command could execute that helper before the user approved the project.
Ordinary git clone does not reproduce arbitrary .git/config, so delivery of effective local filter configuration is an essential precondition. The fix in 2.25.7 is distinct from the earlier executable-search repair.
The second route reached Git's configured helper system. Startup git status could invoke an effective clean or process filter before Safe Mode approved the project, even when the Git executable itself was legitimate. A normal repository clone does not carry a malicious .git/config by default, so the origin and installation of the local filter configuration are prerequisites, not details to omit. The 2.25.7 fix is separate from the earlier Windows search-path repair and the later signature-helper advisory.
Mechanism and trust boundary
- 01
Prepare a repository with an effective malicious local Git filter.
- 02
Open it in the affected Vibe version.
- 03
The initial git status invokes the configured helper before trust approval.
Claims & evidence
CLM-MISTRAL-VIBE-GIT-FILTER-01Running git status under attacker-effective filter configuration reached executable helpers before Safe Mode approval.supported
Basis: reported finding
- supportsVibe pre-trust git status ran configured Git filtersprimary disclosure
Advisory description; git status and clean/process filter drivers; fix 2.25.7
Implications
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Controls and mitigations
- Upgrade Mistral Vibe to at least 2.25.7 and avoid invoking configured Git filters before approving a workspace.
- Inspect effective local Git configuration, not merely the tracked files of a freshly cloned repository.
Unknowns and contradictions
- Ordinary git clone does not reproduce arbitrary .git/config, so delivery of effective local filter configuration is an essential precondition. The fix in 2.25.7 is distinct from the earlier executable-search repair.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229