---
id: 2026-09-mistral-vibe-shell-permission-bypass-cve-batch
title: "Mistral Vibe (Mistral's agentic coding CLI): six shell-permission-check bypasses let an allowlisted command run attacker-chosen code or reach files outside the workspace without an approval prompt — CVE-2026-87983 through CVE-2026-87988, four scored CVSS 10.0, reachable through indirect prompt injection; HiddenLayer disclosed 2026-09-11, Mistral fixed in 2.25.4 (recommends 2.25.8+)"
date_disclosed: 2026-09-11
last_updated: 2026-10-08
severity: critical
status: patched
ecosystems: [pypi, ai-agents, coding-agent]
tools_affected: ["mistral-vibe (Mistral Vibe CLI)"]
tags: [cve, coding-agent, approval-bypass, command-injection, prompt-injection, shell-parsing, path-validation, mistral]
---

## TL;DR
**Mistral Vibe**, Mistral's agentic coding CLI, had its command-approval check bypassed six ways: the parser that decides whether a command needs a human "allow" prompt did not understand shell redirection, ANSI-C quoting, environment-variable prefixes, quoted absolute paths, or several other constructs — so an **allowlisted** command could run attacker-chosen code or read and write files outside the workspace **without a prompt**. Because a coding agent can be steered by **indirect prompt injection** in the content it processes, hostile text in a repo, issue or web page could invoke these. HiddenLayer disclosed them on **2026-09-11** as **CVE-2026-87983 through CVE-2026-87988** (four scored CVSS **10.0**); Mistral shipped the structural fix in **2.25.4** on 2026-09-12 and now recommends **2.25.8 or later**.

## What happened
HiddenLayer's Esteban Tonglet reported a family of permission-check gaps in Mistral Vibe's shell handling. The check reconstructs a command to decide whether it is on the auto-approve allowlist, but its reconstruction dropped whole classes of shell syntax, and the shell then executed the parts the check never saw:

| CVE | Bypass | Affected | Fixed | CVSS 4.0 |
|---|---|---|---|---|
| CVE-2026-87983 | Quoted absolute paths skip path checks | 2.6.0 → 2.19.1 | 2.19.1 | — |
| CVE-2026-87984 | Shell redirection targets not checked (arbitrary file write) | 1.3.4 → 2.25.4 | 2.25.4 | 9.3 |
| CVE-2026-87985 | ANSI-C quoted arguments not exposed to the parser | 2.9.0 → 2.25.4 | 2.25.4 | 10.0 |
| CVE-2026-87986 | Incomplete command parsing (unparsed portions omitted) | 1.3.4 → 2.25.4 | 2.25.4 | 10.0 |
| CVE-2026-87987 | Environment-variable prefixes stripped before the check | 2.6.0 → 2.25.4 | 2.25.4 | 10.0 |
| CVE-2026-87988 | Allowlist and path-validation gaps (command-option bypasses) | 2.15.0 → 2.25.4 | 2.25.4 | 10.0 |

The practical impact, per Mistral's advisory MAI-2026-003, is that an unapproved command could read files outside the workspace (credentials, source), create or overwrite files outside it, or run code as the user — and the vector that makes it matter for a coding agent is indirect prompt injection, since the hostile command rides in on content the agent processes and uses an ordinary-looking program name. Independent researcher **SecMate** reported overlapping issues to Mistral on 2026-09-05; HiddenLayer published 2026-09-11 (Mistral says without pre-notification); Mistral learned of the CVEs on 2026-09-12, shipped **2.25.4** the same day folding in earlier partial fixes (path checks added to the legacy shell in 2.20.0, extended to the managed shell in 2.23.0), and published MAI-2026-003 on 2026-09-14. The vendor recommends **2.25.8+**; the current PyPI release is 2.26.0. This is the same approval-bypass shape as the Cursor, Claude Code and VTCode `find`/allowlist bypasses already in this corpus — the check is a parser, and the shell is a more capable parser than the check.

## Am I affected?
```bash
pip show mistral-vibe 2>/dev/null | grep -i version   # < 2.25.4 is affected; upgrade to 2.25.8+
vibe --version 2>/dev/null
```
Any Mistral Vibe below 2.25.4 is exposed. An affected version means exposure, not compromise — redirections, env assignments and quoted arguments all appear in legitimate commands, so their presence is not evidence of exploitation.

## If you are affected
Upgrade to **2.25.8 or later** and restart running sessions. Keep permission checks on; auto-approve ("YOLO") modes bypass these controls entirely. If you find unauthorised command activity, preserve evidence and rotate credentials the agent could reach — see [if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md) and [agent-sandboxing.md](../prevention/agent-sandboxing.md).

## Prevention
Treat a coding agent's command-allowlist as a parser that will be out-parsed, and sandbox the agent rather than relying on it ([agent-sandboxing.md](../prevention/agent-sandboxing.md)); keep untrusted repos, issues and pages from driving an agent in auto-approve mode ([mcp-hygiene.md](../prevention/mcp-hygiene.md)).

## Sources
- [Mistral — MAI-2026-003: Mistral Vibe shell permission vulnerabilities](https://docs.mistral.ai/resources/security-advisories/MAI-2026-003) (published 2026-09-14: all six CVEs with affected ranges and fixes, timeline, impact, recommend 2.25.4+/2.25.8+)
- [HiddenLayer SAI — CVE-2026-87987: environment variable prefixes stripped from permission check](https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5) and [CVE-2026-87985: ANSI-C quoted strings not exposed to tree-sitter](https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3) (2026-09-11, Esteban Tonglet, CVSS 10.0, mechanism, credits)
- [CVE Services — CVE-2026-87984](https://cveawg.mitre.org/api/cve/CVE-2026-87984), [CVE-2026-87985](https://cveawg.mitre.org/api/cve/CVE-2026-87985), [CVE-2026-87986](https://cveawg.mitre.org/api/cve/CVE-2026-87986), [CVE-2026-87987](https://cveawg.mitre.org/api/cve/CVE-2026-87987), [CVE-2026-87988](https://cveawg.mitre.org/api/cve/CVE-2026-87988) (CNA HiddenLayer, published 2026-09-11, CVSS 4.0 vectors, affected ranges)
- [SecMate — Mistral Vibe shell permission bypass](https://blog.secmate.dev/posts/mistral-vibe-cve-2026-87987-cve-2026-87984/) (2026-09-23, Rossi Bellom / Tofighi Shirazi: independent report 2026-09-05, disclosure timeline, 2.25.4 fix, recommend 2.25.8+)
- [PyPI — mistral-vibe](https://pypi.org/project/mistral-vibe/) (checked 2026-10-08: latest 2.26.0, confirming fix availability)