Mistral Vibe Closes Git Fetch Trust Boundary Gaps
Mistral VibeMistral Vibe closed a cluster of related gaps in how it decides a Git fetch or checkout can run without approval, all stemming from the same trust-boundary pattern: an untrusted repository's own configuration could redirect where Mistral Vibe fetches from, which SSH client or Git hooks it uses, or which credential helper it calls. Read-only-looking Git commands with risky options, hooks, or redirections now require approval, and Git-reader approvals are now scoped to a single repository instead of applying broadly. The fixes land one week after Mistral Vibe patched six CVE-numbered shell permission bypasses in the same general subsystem.
Key Takeaways
- Mistral Vibe closed seven related gaps in how untrusted repository configuration could influence Git fetch, checkout, and approval behavior.
- A malicious repository could previously redirect fetch URLs or hijack credential helpers through inherited config or worktree settings; both paths are now blocked.
- SSH client and Git hook selection during approval-free fetches can no longer be controlled by an untrusted checkout.
- Commands that looked read-only could still carry risky options, hooks, or redirections; those now require explicit approval instead of running free.
- Git-reader approvals are now scoped to a single repository and account for repeated commands and remerge diffs, rather than assuming a broad standing approval.
- The fixes land one week after six CVE-numbered shell permission bypasses in v2.25.4, showing continued hardening of the same approval subsystem.
A Cluster of Fetch-Path Hardening Fixes
Mistral Vibe's v2.25.6 release closed a set of related gaps in how it decides a Git fetch or checkout can run without asking for approval. Each one follows the same shape: a repository a developer has not yet trusted was able to influence how Mistral Vibe talks to Git in ways that reached outside the working directory the developer intended to touch.
What a Malicious Repository Could No Longer Do
Several of the fixes stop a repository's own configuration from redirecting where Mistral Vibe fetches from or how it authenticates. Secure Git fetches no longer trust inherited Git configuration path overrides, and worktree configuration inside a repository can no longer rewrite a fetch URL Mistral Vibe had already validated. An untrusted checkout can no longer choose which SSH client or which Git hooks get used during an approval-free fetch, and Mistral Vibe now rejects encoded network file paths, checkout-controlled credential helpers, and repository-supplied HTTP configuration during secure fetches, each of which was a route a crafted repository could have used to exfiltrate credentials or reach an attacker-controlled host.
Read-Only Commands No Longer Get a Free Pass
Mistral Vibe also tightened what counts as safe to run without asking. Risky options, output operands, repository-defined hooks, and shell redirections attached to an otherwise read-only Git command now require approval, closing a gap where a command that looked read-only could still be made to write somewhere or execute repository-controlled code. Git-reader approvals, the kind Mistral Vibe grants for browsing a repository's history, are now scoped to a single repository and explicitly account for repeated commands and remerge diffs rather than assuming a prior approval still applies. On top of that, interactive pager input now requires approval on PowerShell and whenever session metadata cannot be verified, closing another path where an unverified session could feed input past the approval layer.
Why This Matters
None of these are user-facing features in the ordinary sense: there is no new command, no new UI. What they fix is Mistral Vibe's core promise that an untrusted repository cannot make the agent do more than the developer explicitly approved. Coming one week after Mistral Vibe disclosed and patched six CVE-numbered shell permission bypasses in v2.25.4, this batch shows the same subsystem, Git-related approval logic, continuing to receive scrutiny and hardening rather than being treated as closed after the earlier round of fixes.