PT-2026-137155

CVE-2026-122133

·

Published

2026-11-04

·

Updated

2026-11-04

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-427: Uncontrolled Search Path Element
Related identifiers
CVE-2026-122133
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com