Threats tagged 'ghsa-qx7j-gch3-gv7c'

Mistral Vibe versions before 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by exploiting the repository-configured gpg.program during project context collection. Specifically, a crafted repository setting for gpg.program combined with log.showSignature and a signed commit causes git log to run the attacker's program at session start, before any trust prompt appears.