# mistralai mistral-vibe.

Every CVE that names mistralai mistral-vibe among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program](https://agentprime.io/advisories/CVE-2026-122135.md)
  `CVE-2026-122135` · CVE record: mistralai mistral-vibe · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-829
- [Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers](https://agentprime.io/advisories/CVE-2026-122134.md)
  `CVE-2026-122134` · CVE record: mistralai mistral-vibe · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-829
- [Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe](https://agentprime.io/advisories/CVE-2026-122133.md)
  `CVE-2026-122133` · CVE record: mistralai mistral-vibe · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-427
- [Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode](https://agentprime.io/advisories/CVE-2026-116843.md)
  `CVE-2026-116843` · CVE record: mistralai mistral-vibe · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-829
- [Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform](https://agentprime.io/advisories/CVE-2026-109429.md)
  `CVE-2026-109429` · CVE record: mistralai mistral-vibe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation](https://agentprime.io/advisories/CVE-2026-109428.md)
  `CVE-2026-109428` · CVE record: mistralai mistral-vibe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout](https://agentprime.io/advisories/CVE-2026-93993.md)
  `CVE-2026-93993` · CVE record: mistralai mistral-vibe · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2026 · Tags: CWE-829
- [Incorrect permission assignment in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87988.md)
  `CVE-2026-87988` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands.](https://agentprime.io/advisories/CVE-2026-87987.md)
  `CVE-2026-87987` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-15
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret.](https://agentprime.io/advisories/CVE-2026-87986.md)
  `CVE-2026-87986` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-228
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments.](https://agentprime.io/advisories/CVE-2026-87985.md)
  `CVE-2026-87985` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-184
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87984.md)
  `CVE-2026-87984` · CVE record: mistralai mistral-vibe · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87983.md)
  `CVE-2026-87983` · CVE record: mistralai mistral-vibe · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook](https://agentprime.io/advisories/CVE-2026-67623.md)
  `CVE-2026-67623` · CVE record: mistralai mistral-vibe · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-829

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mistralai-mistral-vibe>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mistralai-mistral-vibe/>. Everything for agents: <https://agentprime.io/llms.txt>.