Threats affecting pkg:brew/mistral-vibe

A vulnerability in the MCP Python SDK HTTP transports (SSE and Streamable HTTP in stateful mode) allows session hijacking by bypassing authentication checks. Incoming requests are routed to existing sessions based solely on session IDs without verifying the authenticated principal. This enables an attacker who obtains a session ID to send JSON-RPC messages on that session regardless of the bearer token used. The issue affects versions from 1.1.1 up to but not including 2.17.0. A fix is available in version 2.17.0.

GitPython versions >=2.1.0 <2.9.2 and >=2.10.0 <2.18.0 contain a vulnerability in config_writer().set_value() that allows newline injection. This enables an attacker to inject a malicious core.hooksPath configuration, causing Git to execute attacker-controlled hooks during operations like commit, merge, or checkout. The flaw arises because set_value() does not validate or reject newline characters in values, and Git accepts indented [core] stanzas as valid configuration sections. This can lead to persistent repository config poisoning and remote code execution in multi-user or shared environments.

GitPython versions up to 3.1.46 and the current main branch (3.1.47 locally) contain a path traversal vulnerability in reference APIs that allows attackers to write, overwrite, move, or delete files outside the repository's .git directory. This occurs due to insufficient validation of reference paths during write, rename, and delete operations. Exploitation requires local access to supply crafted reference paths through applications using GitPython. The vulnerability can lead to high integrity and availability impacts by corrupting or deleting arbitrary files accessible to the process.

GitPython versions from 2.1.0 up to but not including 2.9.0 contain a vulnerability in the handling of multi_options in clone operations. The validation of unsafe options is performed on the original list of options before they are transformed by shlex.split, allowing crafted input strings to bypass checks and inject unsafe git clone options such as --config core.hooksPath. This can lead to execution of attacker-controlled git hooks during repository cloning or submodule updates.

GitPython versions from 2.1.0 up to but not including 2.9.0 contain a command injection vulnerability via unsafe handling of Git options passed as Python kwargs. Specifically, the underscore-form kwargs such as upload_pack and receive_pack bypass the safety checks designed to block dangerous Git options, leading to arbitrary command execution when attacker-controlled input is passed to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This vulnerability is fixed in version 2.9.0.