CVE-2026-67623

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-676246.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676258.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-676266.5Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676284.9Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676296.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-67636.5Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and ThunCVE-2026-676306.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676319.8Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-676336.5Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676369.0Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-676388.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-676398.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67623: High severity, CVSS 8.8 | Vulnix