CVE-2026-93993Patch

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-829

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 5 signals
Disclosure: 1 classified signal
Peaked 2d ago at 3 mentions (2026-09-20); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Patch

480.0%

Disclosure

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	3	Disclosure1Patch2
2026-09-21	1	Patch1
2026-10-27	1	Patch1

Full discourse5 posts

Coiffeur@Coiffeur0x9045d
Patch
🐈 @MistralAI Vibe v2.25.5 is out and fix a Remote Code Execution I reported (CVE-2026-93993). I hope that in the next few days they'll release another update to fix the other RCE I also reported at the same time and which still hasn't been fixed. https://t.co/GwQGopY4Yx
Post summary
The tweet announces the release of Vibe v2.25.5, which addresses a reported Remote Code Execution vulnerability (CVE-2026-93993), while noting another unfixed RCE.
110121827
586 followersView on X
Cody Viveiros@The_Cojovi45d
Patch
Mistral's AI coding agent Vibe had an unpatched RCE — it runs git post-checkout hooks BEFORE the repo is trusted. Patch to 2.25.5. CVE-2026-93993. AI dev tools keep rediscovering supply-chain 101.
Post summary
Mistral's AI coding agent Vibe contains an unpatched remote code execution vulnerability that executes git post-checkout hooks before repository trust validation; a patch to version 2.25.5 is available for mitigation.
0001050
151 followersView on X
Hugo | DevOps | Cybersecurity@HugoValters8d
Patch
CVE-2026-93993: RCE in Mistral Vibe before 2.25.5, git hooks run before trust validation. CVSS 8.8. Patch under review - restrict repo access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93993/ #Mistral #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text discloses a high-severity RCE vulnerability (CVE-2026-93993) in Mistral Vibe prior to v2.25.5, citing technical details and a CVSS score of 8.8, while recommending repo access restriction as a mitigation and noting a patch is under review. No PoC, exploit tool, or active exploitation claim is present.
0000018
1.1K followersView on X
Ryan Merck@rmerck44d
Patch
Nobody should be surprised that worktree setup ran repo hooks first. Mistral Vibe before 2.25.5 let a crafted post-checkout fire before workspace trust. CVE-2026-93993. The interesting part is the ordering, not the CVSS. https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553
Post summary
The post describes CVE-2026-93993 as an ordering issue where a crafted post-checkout hook can execute before workspace trust in Mistral Vibe. It also points to a version threshold and commit that indicate remediation.
0000063
46 followersView on X
CVE@CVEnew45d
Disclosure
CVE-2026-93993 Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers … https://www.cve.org/CVERecord?id=CVE-2026-93993
Post summary
The text announces CVE-2026-93993 as an RCE vulnerability in Mistral Vibe versions before 2.25.5 related to git hook execution before trust validation, without PoC, exploit tooling, active-exploitation claims, or explicit remediation.
00000951
58.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-93993

Hugo | DevOps | Cybersecurity[verified]@HugoValtersPatch

The text discloses a high-severity RCE vulnerability (CVE-2026-93993) in Mistral Vibe prior to v2.25.5, citing technical details and a CVSS score of 8.8, while recommending repo access restriction as a mitigation and noting a patch is under review. No PoC, exploit tool, or active exploitation claim is present.

Ryan Merck[verified]@rmerckPatch

The post describes CVE-2026-93993 as an ordering issue where a crafted post-checkout hook can execute before workspace trust in Mistral Vibe. It also points to a version threshold and commit that indicate remediation.

Coiffeur@Coiffeur0x90Patch

The tweet announces the release of Vibe v2.25.5, which addresses a reported Remote Code Execution vulnerability (CVE-2026-93993), while noting another unfixed RCE.

Cody Viveiros@The_CojoviPatch

Mistral's AI coding agent Vibe contains an unpatched remote code execution vulnerability that executes git post-checkout hooks before repository trust validation; a patch to version 2.25.5 is available for mitigation.

CVE@CVEnewDisclosure

The text announces CVE-2026-93993 as an RCE vulnerability in Mistral Vibe versions before 2.25.5 related to git hook execution before trust validation, without PoC, exploit tooling, active-exploitation claims, or explicit remediation.