CVE-2026-67623: Mistral Vibe remote code execution via malicious fsmonitor hook in git config

Summary

CVE-2026-67623 affects Mistral Vibe before 2.23.3 and enables remote code execution. An attacker plants a malicious core.fsmonitor hook in a repository's .git/config file, which runs when vibe calls git status --porcelain without suppressing hook execution. Running any vibe command in that repository executes arbitrary commands with the victim's full privileges.

Mitigation

Fixed in 2.23.3.

Related items

• InfoMicrosoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 NeuronsSimilar attack · The Hacker News
• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• InfoLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion PersonalizationSimilar attack · Arxiv (cs.RO + cs.CV security)
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide