Mistral Vibe patches a remote code flaw in worktrees
The coding agent's worktree command ran a repository's post-checkout hook before deciding whether that repository could be trusted.
Ask a coding agent to open a repository and you are asking it to run code that somebody else wrote. Mistral's Vibe got that order of operations wrong: when it created a Git worktree for a project, Git ran the repository's own post-checkout hook as part of the checkout, and Vibe had not yet decided whether the project could be trusted. A hostile repository could therefore run shell commands with the privileges of whoever launched the agent.
The flaw, and the fix
The report is public as issue 996 in Mistral's own repository, filed on 11 August and titled plainly enough: remote code execution via worktree creation. It notes that the vulnerable path runs through the worktree helpers the CLI calls on startup, and it includes a short script that builds a repository with a malicious post-checkout hook - a hook Git executes on checkout, which is exactly the moment the agent was preparing the workspace.
Mistral shipped the repair in Vibe 2.25.5 on 18 September. The release notes do not use the word security, but one line in the fixed list is unambiguous: Vibe no longer runs a project-local Git executable during automatic repository inspection. The National Vulnerability Database catalogued the issue the following day as CVE-2026-93993, scoring it 8.8 on the CVSS 3.1 scale and 8.6 on CVSS 4.0, and pointing at the release tag and the commit that carried the change.
Why agent tooling keeps landing here
Vibe is described by Mistral as a minimal CLI coding agent, and it is not a small project any more - the repository has picked up close to five thousand stars since it appeared in December. Agents like it are built to do the things a developer would otherwise type: clone, branch, create worktrees, run hooks and scripts. Each of those is a trust decision, and the interesting part of this bug is that the decision was made a step too late rather than skipped entirely.
The practical exposure is a familiar one for anyone who reviews code from strangers. The attack needs a person to point the agent at a repository they do not control, which is also the everyday workflow for reviewing a pull request or trying somebody's project. Vibe 2.25.5 is the fixed version; the issue has been closed on the project's tracker.
Our opinion
Coding agents have spent a year earning trust by doing more of the work, and the bill for that arrives in exactly this shape. Git hooks are old, deliberately powerful and run by design the moment a repository is touched, so any tool that clones first and judges afterwards is handing a stranger a shell. What makes this case worth remembering is the timeline: the report in August, the fix in a routine release in September, the CVE a day later, and a changelog line that never mentions security at all. Reviewers will keep being asked to open unfamiliar repositories by agents that are optimised for momentum, and the only durable answer is to make trust checks happen before Git gets a vote.