Mistral Vibe versions before 2.23.3 contain a remote code execution vulnerability exploitable via a malicious core.fsmonitor hook embedded in a repository's .git/config file. When a victim runs any vibe command inside a crafted repository, the tool invokes git status --porcelain without suppressing hook execution, triggering the malicious hook. This allows attackers to execute arbitrary commands with the victim's full privileges. The attack vector involves distributing or creating a specially crafted Git repository containing the malicious fsmonitor entry. The vulnerability is fixed in Mistral Vibe version 2.23.3, which suppresses hook execution when invoking git commands. Multiple GitHub references including the fix commit, issue tracker, and pull requests are available. The vulnerability has been assigned CVE-2026-67623 and is documented by VulnCheck as well.