Is CVE-2026-67623 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-67623?

CVE-2026-67623 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-67623

Description

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.