Mistral Vibe `3.0.3`, Datadog `ddtrace` `4.15.6` and `dd-trace-js` `6.20.1`, `rembg` `2.0.82`, Apache Airflow SSH `7.0.1`, and `systeminformation` `5.33.16` patch RCE, ReDoS, and local file disclosure

CVE

CVE-2026-116843, CVE-2026-116588, CVE-2026-116589, CVE-2026-116693, CVE-2026-115924, CVE-2026-116576, CVE-2026-111422

CWE

CWE-78, CWE-88, CWE-22, CWE-1333, CWE-755

Affected Surface

• PyPI `mistral-vibe` versions `< 3.0.3` (`CVE-2026-116843`)
• PyPI `ddtrace` (`DataDog/dd-trace-py`) versions `>= 1.5.0, < 3.19.9` and `>= 4.0.0, < 4.15.6` for `CVE-2026-116588` (`GHSA-3633-r77q-h3v3`), and `>= 3.13.0, < 4.15.5` for `CVE-2026-116589` (`GHSA-p3m5-h5v9-vqj6`)
• npm `dd-trace` (`DataDog/dd-trace-js`) versions `>= 2.0.0, < 5.131.1` and `>= 6.0.0, < 6.20.1` (`CVE-2026-116693` / `GHSA-x94g-w73q-hpcw`)
• PyPI `rembg` versions `< 2.0.82` (`CVE-2026-115924` / `GHSA-qr6x-7v33-6qmg`)
• PyPI `apache-airflow-providers-ssh` versions `>= 4.3.0, < 7.0.1` (`CVE-2026-111422`)
• npm `systeminformation` versions `< 5.33.16` on Windows (`CVE-2026-116576` / `GHSA-3f7j-7jwc-fxfj`)

Update, 28 October 2026: Late on 27 October (21:07 UTC), Datadog published CVE-2026-116693 (GHSA-x94g-w73q-hpcw, High) for its Node.js APM tracer dd-trace (>= 2.0.0, < 5.131.1 and >= 6.0.0, < 6.20.1). It is the direct JavaScript counterpart to Python ddtrace’s CVE-2026-116588: packages/dd-trace/src/plugins/util/url.js (obfuscateQs) ran the same ambiguous ey[I-L](?:[\w=-]|%3D)+ JWT and quoted-value regex synchronously on incoming HTTP query strings on the Node.js event loop. Upgrade dd-trace on npm to >= 6.20.1 (6.22.0 is current) or >= 5.131.1 (commit 5eeee790c9).

TL;DR

On 26 and 27 October 2026, six vulnerabilities affecting Python AI/ML tooling, APM agents, workflow orchestrators, and Node.js system utilities were published to NVD and oss-security:

1. Mistral Vibe < 3.0.3 (CVE-2026-116843, CVSS 8.8 High): Mistral’s CLI coding agent disabled core.fsmonitor and core.hooksPath when inspecting repositories, but did not disable repository-defined Git filter drivers (filter.<name>.clean, smudge, process). When a developer launched vibe --worktree (or when background worktree cleanup ran git status / git add) inside an untrusted repository, Git applied .gitattributes and executed the attacker’s filter commands from .git/config before the trusted-folder prompt ran.
2. Datadog ddtrace < 3.19.9 / < 4.15.6 (CVE-2026-116588, CVSS 8.7 High) and < 4.15.5 (CVE-2026-116589, CVSS 8.2 High): In dd-trace-py, the default query-string obfuscation regex (DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP_DEFAULT) used |ey[I-L](?:[\w=-]|%3D)+\.ey[I-L](?:[\w=-]|%3D)+... with overlapping quantifiers that ran synchronously on every traced HTTP request, letting an unauthenticated caller stall Python web workers with a crafted query string (CVE-2026-116588). Separately, when Datadog IAST was enabled, passing a tainted string containing a lone UTF-16 surrogate (\ud800) to old-style % formatting threw an uncaught C++ UTF-8 conversion exception inside ddtrace/appsec/_iast/_taint_tracking/aspects/aspect_modulo.cpp, aborting the Python process (CVE-2026-116589).
3. rembg < 2.0.82 (CVE-2026-115924 / GHSA-qr6x-7v33-6qmg, CVSS 8.6 High): The public /api/remove endpoint accepted an unvalidated extras.sam_model string and interpolated it directly into local paths and pooch.retrieve() download URLs without checksum verification. By combining path traversal (../) with a URL fragment (#), an unauthenticated attacker could make the HTTP client discard the fragment while the local filesystem retained it, plant attacker-controlled .encoder.onnx and .decoder.onnx graphs next to a sensitive local file, load that file via ONNX external-data tensors, and return the file’s contents encoded inside the output PNG mask.
4. Node.js systeminformation < 5.33.16 (CVE-2026-116576 / GHSA-3f7j-7jwc-fxfj, CVSS 7.8 High): On Windows, services(srv) passed caller-supplied service names through sanitizeShellString() into a PowerShell Get-CimInstance filter. Because sanitizeShellString() stripped ASCII quotes (' and ") but allowed Unicode quotation marks (U+2018 through U+201E) and dashes (U+2013 through U+2015) that Windows PowerShell accepts as string delimiters and flag prefixes, an attacker who controlled the services() argument could break out of the filter string and execute arbitrary PowerShell commands.
5. Apache Airflow SSH Provider 4.3.0 to < 7.0.1 (CVE-2026-111422): SSHRemoteJobOperator in apache-airflow-providers-ssh single-quoted templated environment dictionary values only once even though env_exports was spliced inside an already single-quoted setsid sh -c '...' wrapper script. Any DAG that populated environment from dag_run.conf or params allowed a user with DAG-trigger permissions to execute arbitrary shell commands ($(...)) on the remote SSH host.

What to do now: Upgrade mistral-vibe to 3.0.3, ddtrace to 4.15.6 (or 3.19.9 on the 3.x branch), rembg to 2.0.82+ (2.0.86 is current), apache-airflow-providers-ssh to 7.0.1, and systeminformation to 5.33.16.

Affected packages and projects

Ecosystem	Package	CVE / Advisory	Severity	Affected versions	Fixed version	Vulnerable component
PyPI	mistral-vibe	CVE-2026-116843	CVSS 8.8 High	< 3.0.3	3.0.3	vibe/core/git/repo.py (sanitized_git), vibe/core/git/worktree/repository.py
PyPI	ddtrace	CVE-2026-116588 (GHSA-3633-r77q-h3v3)	CVSS 8.7 High	>= 1.5.0, < 3.19.9; >= 4.0.0, < 4.15.6	3.19.9, 4.15.6	ddtrace/internal/settings/_config.py (DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP_DEFAULT)
npm	dd-trace	CVE-2026-116693 (GHSA-x94g-w73q-hpcw)	High	>= 2.0.0, < 5.131.1; >= 6.0.0, < 6.20.1	5.131.1, 6.20.1	packages/dd-trace/src/plugins/util/url.js (obfuscateQs / DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP)
PyPI	ddtrace	CVE-2026-116589 (GHSA-p3m5-h5v9-vqj6)	CVSS 8.2 High	>= 3.13.0, < 4.15.5	4.15.5	ddtrace/appsec/_iast/_taint_tracking/aspects/aspect_modulo.cpp (api_modulo_aspect)
PyPI	rembg	CVE-2026-115924 (GHSA-qr6x-7v33-6qmg)	CVSS 8.6 High	< 2.0.82	2.0.82	rembg/sessions/sam.py (SamSession.download_models)
npm	systeminformation	CVE-2026-116576 (GHSA-3f7j-7jwc-fxfj)	CVSS 7.8 High	< 5.33.16 (Windows)	5.33.16	lib/util.js (sanitizeShellString), lib/processes.js (services)
PyPI	apache-airflow-providers-ssh	CVE-2026-111422	Medium / High (context-dependent)	>= 4.3.0, < 7.0.1	7.0.1	airflow/providers/ssh/utils/remote_job.py (build_posix_wrapper_command)

Technical analysis

1. CVE-2026-116843: pre-trust .git/config filter driver execution in Mistral Vibe --worktree

When an AI coding CLI opens an unfamiliar repository, running git subcommands safely before the user approves the folder requires neutralizing every configuration key that lets a repository execute shell commands. Previously, sanitized_git() in vibe/core/git/repo.py only overrode core.fsmonitor and core.hooksPath:

--- a/vibe/core/git/repo.py
+++ b/vibe/core/git/repo.py
@@ -50,6 +51,15 @@
 _NO_HOOKS_CONFIG = "core.hooksPath=/nonexistent-vibe-disabled-git-hooks"
+# Filter drivers are the third, for a repository the user has not trusted:
+# `.gitattributes` in the checkout selects a driver by name, and checkout,
+# status and add run that driver's smudge, clean or process command. Only
+# drivers the repository's own config defines are switched off; one the user
+# configured themselves, such as Git LFS's, still runs.
+_FILTER_COMMAND_KEYS = ("smudge", "clean", "process")
...
-def sanitized_git(repo: Repo, *extra_config: str, cwd: Path | None = None) -> Git:
+def sanitized_git(
+    repo: Repo,
+    *extra_config: str,
+    cwd: Path | None = None,
+    trust_store: TrustedFoldersManager | None = None,
+    trust_root: Path | None = None,
+) -> Git:
...
-    config = ["core.fsmonitor=", _NO_HOOKS_CONFIG, *extra_config]
+    config = [
+        "core.fsmonitor=",
+        _NO_HOOKS_CONFIG,
+        *(
+            ()
+            if repository_is_trusted(repo, trust_store, trust_root=trust_root)
+            else _repository_filter_overrides(repo, cwd=cwd)
+        ),
+        *extra_config,
+    ]

If an attacker placed *.py filter=evil in .gitattributes and configured [filter "evil"] smudge = ... or clean = ... in the repository’s local .git/config (or planted a submodule), starting vibe --worktree ran git worktree add, git status, or worktree snapshot cleanup before the folder was trusted, executing the filter command with the developer’s privileges. mistral-vibe 3.0.3 enumerates local filter.<name>.{smudge,clean,process} keys via git config --local and passes -c filter.<name>.smudge= / clean= / process= overrides (plus --ignore-submodules=all on untrusted status checks) whenever the repository root is not in TrustedFoldersManager.

2. CVE-2026-116588 and CVE-2026-116589: Datadog ddtrace query-string ReDoS and IAST % formatting crash

By default, Datadog’s Python tracer redacts credentials from HTTP query strings before recording the http.url span attribute. In ddtrace 1.5.0 through 3.19.8 and 4.0.0 through 4.15.5, DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP_DEFAULT in ddtrace/internal/settings/_config.py included a JWT-matching branch with nested, overlapping alternatives ((?:[\w=-]|%3D)+, where = appears both inside [\w=-] and at the start of %3D) and a value-matching branch (?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22):

--- a/ddtrace/internal/settings/_config.py
+++ b/ddtrace/internal/settings/_config.py
@@ -88,10 +88,11 @@
     r'(?:"|%22)'  # closing '"' at end of value
     r")"
     r"|(?:"  # other common secret values
-    r" bearer(?:\s|%20)+[a-z0-9._\-]+"
+    r"bearer(?:\s|%20)+[a-z0-9._\-]+"
     r"|token(?::|%3A)[a-z0-9]{13}"
     r"|gh[opsu]_[0-9a-zA-Z]{36}"
-    r"|ey[I-L](?:[\w=-]|%3D)+\.ey[I-L](?:[\w=-]|%3D)+(?:\.(?:[\w.+/=-]|%3D|%2F|%2B)+)?"
+    r"|(^|[^\w%-]|%[0-9a-f]{2})ey[I-L][\w-]+(?:=|%3D)*\.ey[I-L][\w-]+(?:=|%3D)*"
+    r"(?:\.(?:[\w.+/=-]|%3D|%2F|%2B)+)?"

In addition, when IAST was enabled on non-ASCII query strings, find_query_string_matches() in url_sensitive_analyzer.py recomputed UTF-8 byte-to-character offsets inside the match loop, compounding the quadratic regex backtracking. Commit 83ea39845d (v4.15.6 / v3.19.9) rewrites the JWT and quote patterns to eliminate ambiguous repetition and precomputes byte_to_char once in linear time.

For CVE-2026-116589, commit 69dc198532 (v4.15.5) wraps api_modulo_aspect() in ddtrace/appsec/_iast/_taint_tracking/aspects/aspect_modulo.cpp inside TRY_CATCH_ASPECT("modulo_aspect", return return_candidate_result(), ...) so that when tainted input containing a lone surrogate (such as \ud800bad) fails native UTF-8 conversion during % string formatting, the C++ extension falls back to the plain formatted string instead of aborting the Python interpreter.

3. CVE-2026-115924: rembg /api/remove sam_model URL-fragment traversal and ONNX file exfiltration

In rembg before 2.0.82, SamSession.download_models() built the local filename and the GitHub Releases download URL directly from the caller-supplied sam_model parameter in POST /api/remove without checking an allowlist or passing a known_hash to pooch.retrieve().

Because an HTTP client strips the URL fragment (#...) before sending the request over the wire while POSIX file APIs treat # as an ordinary filename character, an attacker could send a sam_model containing #/../../.... On the first request, pooch created the traversed directory tree; on the second request, rembg downloaded attacker-crafted .encoder.onnx and .decoder.onnx files next to a target file on disk. By using ONNX’s external-data mechanism (data_location pointing at a relative file such as .env or an SSH key), the injected ONNX graph loaded the secret file’s bytes into a tensor and rendered them into the output PNG image returned by /api/remove. Commit b2758c6b39 restricts sam_model to a strict SAM_MODELS allowlist (sam_vit_b_01ec64, sam_vit_l_0b3195, sam_vit_h_4b8939) and pins MD5 checksums for every .onnx asset in SAM_CHECKSUMS.

4. CVE-2026-116576 in Node.js systeminformation and CVE-2026-111422 in apache-airflow-providers-ssh

Both command-injection bugs come from mismatches between a sanitizer’s quoting model and the target shell’s parser:

• Windows PowerShell smart-quote breakout in systeminformation (CVE-2026-116576, commit 5014c6d25c): Windows PowerShell treats Unicode typographic quotes (U+2018 through U+201E) as valid string delimiters equivalent to ASCII ' and ", and treats en/em dashes (U+2013 through U+2015) as parameter dashes (-). Because sanitizeShellString() in lib/util.js only stripped ASCII ' and ", passing a service name containing U+201D into si.services(userInput) closed the Get-CimInstance filter string early and injected arbitrary PowerShell expressions:

--- a/lib/util.js
+++ b/lib/util.js
@@ -749,6 +749,9 @@ function sanitizeShellString(str, strict) {
         s[i] === "'" ||
         s[i] === '`' ||
         s[i] === '"' ||
+        // unicode quotes (U+2018-U+201E) and dashes (U+2013-U+2015) are treated as ' " - by PowerShell
+        (s[i] >= '‘' && s[i] <= '„') ||
+        (s[i] >= '–' && s[i] <= '―') ||
         s[i].length > 1 ||

• Single-quoted setsid sh -c '...' unquoting in SSHRemoteJobOperator (CVE-2026-111422, Airflow PR #74810): In airflow/providers/ssh/utils/remote_job.py, build_posix_wrapper_command() formatted each environment variable as export {key}='{escaped_value}'\n and then interpolated {env_exports} directly inside an outer single-quoted setsid sh -c '...' string without escaping the single quotes around {escaped_value} for the outer shell. The inner single quotes therefore closed the outer sh -c '...' literal, leaving {escaped_value} unquoted in the outer shell where $(...) and backticks executed immediately on the remote SSH host:

--- a/providers/ssh/src/airflow/providers/ssh/utils/remote_job.py
+++ b/providers/ssh/src/airflow/providers/ssh/utils/remote_job.py
@@ -183,10 +183,11 @@ def build_posix_wrapper_command(
     if environment:
         for key, value in environment.items():
             _validate_env_var_name(key)
-            escaped_value = value.replace("'", "'\"'\"'")
-            env_exports += f"export {key}='{escaped_value}'\n"
+            env_exports += f"export {key}={shlex.quote(value)}\n"
 
-    escaped_command = command.replace("'", "'\"'\"'")
+    # The exports and the command are spliced into the single-quoted ``job_script`` literal
+    # below, so escape them for it once more on top of the per-value quoting.
+    escaped_job_body = (env_exports + command).replace("'", "'\"'\"'")

Detection and remediation

# 1. Check Python and Node.js dependency manifests and lockfiles for vulnerable versions
rg -n '(mistral-vibe|ddtrace|rembg|apache-airflow-providers-ssh)' \
  requirements*.txt pyproject.toml uv.lock poetry.lock Pipfile.lock 2>/dev/null

rg -n '"systeminformation"' package.json package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

# 2. Search Airflow DAGs for SSHRemoteJobOperator calls passing templated environment dicts
rg -n -C 4 'SSHRemoteJobOperator' dags/ 2>/dev/null

# 3. Search Node.js codebases for systeminformation services() or getDynamicData() calls
rg -n '\b(si\.)?(services|getDynamicData)\s*\(' src/ lib/ app/ 2>/dev/null

1. Upgrade Python packages: Upgrade mistral-vibe >= 3.0.3, ddtrace >= 4.15.6 (or >= 3.19.9), rembg >= 2.0.82, and apache-airflow-providers-ssh >= 7.0.1. If a Python service running ddtrace cannot be upgraded immediately, setting DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP="" disables query-string regex obfuscation (at the cost of stripping query strings from span URLs).
2. Upgrade systeminformation: Upgrade to systeminformation >= 5.33.16 on any Windows Node.js service or Electron application, and validate service names against an alphanumeric allowlist before calling si.services().

Timeline

• 2026-09-02: danielgatis/rembg merges commit b2758c6b39 (SAM_CHECKSUMS and SAM_MODELS allowlist for CVE-2026-115924) and releases rembg v2.0.82.
• 2026-10-06 to 2026-10-09: Datadog merges 69dc198532 (CVE-2026-116589 in ddtrace v4.15.5) and 83ea39845d / 63ddc3cb07 (CVE-2026-116588 in ddtrace v4.15.6 and v3.19.9).
• 2026-10-19: sebhildebrandt/systeminformation merges commit 5014c6d25c (CVE-2026-116576) and publishes v5.33.16.
• 2026-10-26 to 2026-10-27: Mistral AI releases mistral-vibe 3.0.3 (CVE-2026-116843), Apache publishes the CVE-2026-111422 advisory for apache-airflow-providers-ssh 7.0.1 to oss-security, and NVD publishes CVE-2026-116843, CVE-2026-116588, CVE-2026-116589, CVE-2026-116576, and CVE-2026-115924.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo

References

• NVD: CVE-2026-116843 (Mistral Vibe git filter driver RCE in worktree mode)
• DataDog/dd-trace-py commits 83ea39845d and 69dc198532 (CVE-2026-116588, CVE-2026-116589)
• DataDog/dd-trace-js advisory GHSA-x94g-w73q-hpcw and commit 5eeee790c9 (CVE-2026-116693)
• danielgatis/rembg commit b2758c6b39: restrict sam_model to published checkpoints (CVE-2026-115924 / GHSA-qr6x-7v33-6qmg)
• sebhildebrandt/systeminformation commit 5014c6d25c: strip Unicode quotes and dashes in sanitizeShellString (CVE-2026-116576)
• Apache Airflow PR #74810 and oss-security advisory: CVE-2026-111422 in apache-airflow-providers-ssh