Mistral Vibe (Mistral's agentic coding CLI): six shell-permission-check bypasses let an allowlisted command run attacker-chosen code or reach files outside the workspace without an approval prompt — CVE-2026-87983 through CVE-2026-87988, four scored CVSS 10.0, reachable through indirect prompt injection; HiddenLayer disclosed 2026-09-11, Mistral fixed in 2.25.4 (recommends 2.25.8+)

View raw markdownEdit on GitHub ↗

TL;DR

Mistral Vibe, Mistral's agentic coding CLI, had its command-approval check bypassed six ways: the parser that decides whether a command needs a human "allow" prompt did not understand shell redirection, ANSI-C quoting, environment-variable prefixes, quoted absolute paths, or several other constructs — so an allowlisted command could run attacker-chosen code or read and write files outside the workspace without a prompt. Because a coding agent can be steered by indirect prompt injection in the content it processes, hostile text in a repo, issue or web page could invoke these. HiddenLayer disclosed them on 2026-09-11 as CVE-2026-87983 through CVE-2026-87988 (four scored CVSS 10.0); Mistral shipped the structural fix in 2.25.4 on 2026-09-12 and now recommends 2.25.8 or later.

What happened

HiddenLayer's Esteban Tonglet reported a family of permission-check gaps in Mistral Vibe's shell handling. The check reconstructs a command to decide whether it is on the auto-approve allowlist, but its reconstruction dropped whole classes of shell syntax, and the shell then executed the parts the check never saw:

CVE Bypass Affected Fixed CVSS 4.0
CVE-2026-87983 Quoted absolute paths skip path checks 2.6.0 → 2.19.1 2.19.1 —
CVE-2026-87984 Shell redirection targets not checked (arbitrary file write) 1.3.4 → 2.25.4 2.25.4 9.3
CVE-2026-87985 ANSI-C quoted arguments not exposed to the parser 2.9.0 → 2.25.4 2.25.4 10.0
CVE-2026-87986 Incomplete command parsing (unparsed portions omitted) 1.3.4 → 2.25.4 2.25.4 10.0
CVE-2026-87987 Environment-variable prefixes stripped before the check 2.6.0 → 2.25.4 2.25.4 10.0
CVE-2026-87988 Allowlist and path-validation gaps (command-option bypasses) 2.15.0 → 2.25.4 2.25.4 10.0

The practical impact, per Mistral's advisory MAI-2026-003, is that an unapproved command could read files outside the workspace (credentials, source), create or overwrite files outside it, or run code as the user — and the vector that makes it matter for a coding agent is indirect prompt injection, since the hostile command rides in on content the agent processes and uses an ordinary-looking program name. Independent researcher SecMate reported overlapping issues to Mistral on 2026-09-05; HiddenLayer published 2026-09-11 (Mistral says without pre-notification); Mistral learned of the CVEs on 2026-09-12, shipped 2.25.4 the same day folding in earlier partial fixes (path checks added to the legacy shell in 2.20.0, extended to the managed shell in 2.23.0), and published MAI-2026-003 on 2026-09-14. The vendor recommends 2.25.8+; the current PyPI release is 2.26.0. This is the same approval-bypass shape as the Cursor, Claude Code and VTCode find/allowlist bypasses already in this corpus — the check is a parser, and the shell is a more capable parser than the check.

Am I affected?

pip show mistral-vibe 2>/dev/null | grep -i version   # < 2.25.4 is affected; upgrade to 2.25.8+
vibe --version 2>/dev/null

Any Mistral Vibe below 2.25.4 is exposed. An affected version means exposure, not compromise — redirections, env assignments and quoted arguments all appear in legitimate commands, so their presence is not evidence of exploitation.

If you are affected

Upgrade to 2.25.8 or later and restart running sessions. Keep permission checks on; auto-approve ("YOLO") modes bypass these controls entirely. If you find unauthorised command activity, preserve evidence and rotate credentials the agent could reach — see if-your-local-ai-agent-was-exploited.md and agent-sandboxing.md.

Prevention

Treat a coding agent's command-allowlist as a parser that will be out-parsed, and sandbox the agent rather than relying on it (agent-sandboxing.md); keep untrusted repos, issues and pages from driving an agent in auto-approve mode (mcp-hygiene.md).

Sources