Threats tagged 'ghsa-4c2h-cpg4-cvr2'

Mistral Vibe versions before 2.25.5 on Windows are affected by an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe file in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt appears. The vulnerability has a high severity with a CVSS score of 8.8.