{"schema":"threatline.record/2","record":{"id":"CVE-2026-116843","aliases":[],"summary":"Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode","details":"Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.","categories":["Unclassified"],"product":"mistral-vibe","vendor":"mistralai","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116843","source_modified_at":"2026-10-27T00:34:01.754Z","fetched_at":"2026-10-27T04:51:10.072820Z","product":"mistral-vibe","vendor":"mistralai","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"3.0.3"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116843","source_modified_at":"2026-10-27T00:34:01.754Z","fetched_at":"2026-10-27T04:51:10.072820Z","package":{"name":"mistral-vibe","ecosystem":null},"version":"3.0.3","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T00:34:01.754Z","modified_at":"2026-10-27T00:34:01.754Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116843","fetched_at":"2026-10-27T04:51:10.072820Z","source_modified_at":"2026-10-27T00:34:01.754Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/issues/997","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00","tags":["patch"]},{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T00:34:01.754Z","content_hash":"2d1f0998e86929efa9f93dbce7f7af38f2a96f80b55a7028c55accd1b4dd9880"}}