Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe

Summary

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.

Remediation

1. Inventory every mistralai mistral-vibe deployment, including staging.
2. Upgrade mistralai mistral-vibe to 2.25.5.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
• Advisoryhttps://www.vulncheck.com/advisories/mistral-vibe-before-2.25.5-on-windows-untrusted-search-path-rce-via-git-exe
• Referencehttps://github.com/mistralai/mistral-vibe
• Referencehttps://github.com/mistralai/mistral-vibe/blob/v2.25.5/CHANGELOG.md?plain=1#L81
• Referencehttps://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5
• Referencehttps://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/system_prompt.py#L51-L64
• Referencehttps://github.com/mistralai/mistral-vibe/blob/v2.25.4/vibe/core/session/session_logger.py#L137-L141