{"id":"CVE-2026-116843","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-116843","summary":"Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode","details":"Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.","published":"2026-10-27T00:34:01.754Z","modified":"2026-10-28T02:59:29.985264155Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00","label":"mistralai/mistral-vibe@7bb48f2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116843.json"},{"type":"ADVISORY","url":"https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116843"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode"},{"type":"REPORT","url":"https://github.com/mistralai/mistral-vibe/issues/997"},{"type":"FIX","url":"https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00"},{"type":"ARTICLE","url":"https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:59:29.985264155Z"}}