Threats tagged 'ghsa-xwx6-2mm7-g8wj'

Mistral Vibe versions prior to 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, enabling execution of attacker-controlled commands with user privileges.