Evidence · DiggingBeagle record
Vibe on Windows launched an attacker-controlled git.exe before repository trust
CVE-2026-122133 described project-local executable lookup before Safe Mode checks.
- Source role
- primary disclosure
Evidence record
CVE-2026-122133 described project-local executable lookup before Safe Mode checks.
Claim-level citations (1)
- supportsMistral Vibe on Windows could execute a project-local git.exe before the workspace trust decision: Mistral Vibe startup invoked git from the search path before approving a repository, enabling a malicious selected git.exe to run as the current user.
Advisory description; SessionLogger and ProjectContextProvider; fix 2.25.5