rpm package
opensuse/mistral-vibe&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/mistral-vibe&distro=openSUSE%20Tumbleweed
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-93993 | Hig | 8.8 | < 2.25.8-1.1 | 2.25.8-1.1 | Sep 19, 2026 | Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileg | |
| CVE-2026-87987 | Cri | — | < 2.25.4-1.1 | 2.25.4-1.1 | Sep 11, 2026 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variabl | |
| CVE-2026-87984 | Cri | — | < 2.25.4-1.1 | 2.25.4-1.1 | Sep 11, 2026 | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowliste |
- affected < 2.25.8-1.1fixed 2.25.8-1.1
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileg
- affected < 2.25.4-1.1fixed 2.25.4-1.1
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variabl
- affected < 2.25.4-1.1fixed 2.25.4-1.1
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowliste