CVE-2026-93993 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Mistral Vibe **executes hooks before verifying trust** when creating a Git worktree. 📉 **Consequence**: Attackers can execute arbitrary Shell commands (RCE) by crafting a `post-checkout` hook.

Q: Root Cause? (CWE/Flaw)

🔍 **Defect Point**: In the `add_worktree` function, Git hooks are triggered before the trust check. CWE Classification: CWE-94 (Code Injection) / CWE-250 (Execution with Unnecessary Privileges or Permissions).

Q: Who is affected? (Versions/Components)

📦 **Affected Component**: Mistral Vibe. 📉 **Affected Versions**: All versions prior to v2.25.5 (including v2.25.4 and earlier).

Q: What can hackers do? (Privileges/Data)

💥 **Attacker Capabilities**: - Execute arbitrary commands with the privileges of the user running Vibe. - Read/modify codebases, steal environment variables, or implant backdoors.

Q: Is exploitation threshold high? (Auth/Config)

📊 **Exploitability Threshold**: - **No Authentication Required** (PR:N). - **Low Complexity** (AC:L). - User Interaction Required (UI:R): The user must be induced to check out a malicious repository.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **PoC Status**: - The `pocs` field in the data is empty; no public PoC is currently available. - No records of in-the-wild exploitation (based on provided data).

Q: How to self-check? (Features/Scanning)

🔎 **Self-Assessment Method**: 1. Check if the Vibe version is < 2.25.5. 2. Audit the content of the `.git/hooks/post-checkout` file in the Git repository. 3. Use `git config core.hooksPath` to check the custom hook path.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: - **v2.25.5** has been released to fix this vulnerability. - Patch commit: `c069ffa` (adjusted execution order to verify trust before executing hooks).

Q: What if no patch? (Workaround)

🛡️ **Temporary Mitigation**: - Upgrade to v2.25.5+. - If unable to upgrade: disable Git hooks (`git config core.hooksPath /dev/null`) or avoid checking out untrusted repositories.

Q: Is it urgent? (Priority Suggestion)

⏰ **Priority**: - **High** (CVSS 9.8 Critical). - Immediate upgrade is recommended, especially in scenarios involving CI/CD or handling external code.

Updated Sep 20, 2026 CVSS 8.8 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Mistral Vibe **executes hooks before verifying trust** when creating a Git worktree.
📉 **Consequence**: Attackers can execute arbitrary Shell commands (RCE) by crafting a `post-checkout` hook.

Q2Root Cause? (CWE/Flaw)

🔍 **Defect Point**: In the `add_worktree` function, Git hooks are triggered before the trust check.
CWE Classification: CWE-94 (Code Injection) / CWE-250 (Execution with Unnecessary Privileges or Permissions).

Q3Who is affected? (Versions/Components)

📦 **Affected Component**: Mistral Vibe.
📉 **Affected Versions**: All versions prior to v2.25.5 (including v2.25.4 and earlier).

Q4What can hackers do? (Privileges/Data)

💥 **Attacker Capabilities**:
- Execute arbitrary commands with the privileges of the user running Vibe.
- Read/modify codebases, steal environment variables, or implant backdoors.

Q5Is exploitation threshold high? (Auth/Config)

📊 **Exploitability Threshold**:
- **No Authentication Required** (PR:N).
- **Low Complexity** (AC:L).
- User Interaction Required (UI:R): The user must be induced to check out a malicious repository.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧪 **PoC Status**:
- The `pocs` field in the data is empty; no public PoC is currently available.
- No records of in-the-wild exploitation (based on provided data).

Q7How to self-check? (Features/Scanning)

🔎 **Self-Assessment Method**:
Check if the Vibe version is < 2.25.5.
Audit the content of the `.git/hooks/post-checkout` file in the Git repository.
Use `git config core.hooksPath` to check the custom hook path.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**:
- **v2.25.5** has been released to fix this vulnerability.
- Patch commit: `c069ffa` (adjusted execution order to verify trust before executing hooks).

Q9What if no patch? (Workaround)

🛡️ **Temporary Mitigation**:
- Upgrade to v2.25.5+.
- If unable to upgrade: disable Git hooks (`git config core.hooksPath /dev/null`) or avoid checking out untrusted repositories.

Q10Is it urgent? (Priority Suggestion)

⏰ **Priority**:
- **High** (CVSS 9.8 Critical).
- Immediate upgrade is recommended, especially in scenarios involving CI/CD or handling external code.

Continue exploring

Vulnerability detail Full AI analysis (login) mistralai CWE-829