CVE-2026-116843
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Oct 27, 2026
CISA due date
—
The record
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-829
- CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
- CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
- CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
- CVE-2026-114488 A flaw was found in Wildfly. CWE-829
- CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… CWE-829
- CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
- CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829