During startup, Vibe gathered repository context by invoking Git. On Windows, executable lookup could select a git.exe placed earlier in the effective search order by the project. This execution occurred before the tool presented its workspace trust decision. The attacker must place a runnable executable in a path the system selects. This is not…
Inspect the ClaimsCase · DiggingBeagle record
Mistral Vibe on Windows could execute a project-local git.exe before the workspace trust decision
Mistral Vibe startup invoked git from the search path before approving a repository, enabling a malicious selected git.exe to run as the current user.
Public disclosure: Nov 4, 2026
Scope
Coding-agent initialization on prepared local repositories with the stated Git configuration or executable-search preconditions.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Published technical advisory describes project-local executable lookup before trust on Windows, requiring delivered executable search-path control. No field compromise is reported. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MISTRAL-VIBE-FAKE-GIT-EXE-01 · Vibe on Windows launched an attacker-controlled git.exe before repository trust
At a glance
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Read the implicationsThe attacker must place a runnable executable in a path the system selects. This is not demonstrated remote code execution from ordinary text alone or a confirmed Linux attack. The vulnerability was patched in 2.25.5.
Limits and uncertaintyFull account
During startup, Vibe gathered repository context by invoking Git. On Windows, executable lookup could select a git.exe placed earlier in the effective search order by the project. This execution occurred before the tool presented its workspace trust decision.
The attacker must place a runnable executable in a path the system selects. This is not demonstrated remote code execution from ordinary text alone or a confirmed Linux attack. The vulnerability was patched in 2.25.5.
This route depends on Windows executable lookup, not on a hostile prompt in a repository file. During session setup, Git discovery could resolve a project-local git.exe before the workspace approval check. That binary ran with the user's operating-system rights, provided an attacker had arranged for it to be in the lookup path. The reported fix begins at 2.25.5; it addresses executable resolution but does not by itself account for later distinct Git filter and signature-helper routes.
Mechanism and trust boundary
- 01
Open a prepared project on Windows.
- 02
Startup Git discovery resolves the project-controlled executable.
- 03
The executable runs with the developer user permissions before trust approval.
Claims & evidence
CLM-MISTRAL-VIBE-FAKE-GIT-EXE-01Mistral Vibe startup invoked git from the search path before approving a repository, enabling a malicious selected git.exe to run as the current user.supported
Basis: reported finding
- supportsVibe on Windows launched an attacker-controlled git.exe before repository trustprimary disclosure
Advisory description; SessionLogger and ProjectContextProvider; fix 2.25.5
Implications
A workspace confirmation displayed after repository inspection cannot undo a subprocess that already ran.
Controls and mitigations
- Upgrade Mistral Vibe to at least 2.25.5 and ensure pretrust Git discovery resolves a trusted Git executable rather than consulting the project directory.
- Audit process launches before workspace approval, including configured Git helpers addressed by later advisories.
Unknowns and contradictions
- The attacker must place a runnable executable in a path the system selects. This is not demonstrated remote code execution from ordinary text alone or a confirmed Linux attack. The vulnerability was patched in 2.25.5.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229