Mistral Vibe: Six Command Permission Bypasses — Four CVSS 10.0 Enable Silent Arbitrary Command Execution

HiddenLayer disclosed six authorization-layer bugs in Mistral Vibe, CVE-2026-87983 through 87988. Four score CVSS 10.0. Attackers can make the AI coding assistant execute arbitrary commands with no confirmation prompt.

On 11 Sep 2026, HiddenLayer, acting as CNA, disclosed six vulnerabilities in Mistral's CLI coding agent Mistral Vibe: CVE-2026-87983 through CVE-2026-87988. Four rate CVSS 4.0 10.0; the other two are 9.3 and 9.2. All six sit in the same layer: the authorization module that decides whether a shell command may run without user confirmation. Attackers can make Vibe silently execute arbitrary commands and read or write arbitrary files on the workstation.

Incident Overview

Mistral Vibe is Mistral's terminal coding agent, Apache 2.0, distributed via PyPI, official install script, uv, or pip. Runs on the developer machine and inherits that account's privileges. Ships a shell execution tool; some calls auto-approve with no confirmation prompt. All six CVEs reported by Esteban Tonglet. Attack surface is not the model; it is the outer authorization code: string parsing, hand-maintained allowlists, path normalization.

Technical Details

Shared mechanism in one sentence: Vibe builds a syntax tree with tree-sitter-bash, reconstructs a command representation from it, and authorizes against that representation; the shell executes the original string. Drop anything the shell still honors during reconstruction, and the judgment object diverges from what actually runs. Five of six paths are this class. The sixth is a gap between two internal lists.

• CVE-2026-87983 (9.2, CWE-22): Quotes in the path are preserved. Absolute paths that start with a quote are no longer classified as absolute, so reading an absolute-path file skips confirmation.
• CVE-2026-87984 (9.3, CWE-22): Shell redirect targets are not extracted. Arbitrary file write.
• CVE-2026-87985 (10.0, CWE-184): ANSI-C quoted arguments are not collected. `find`'s `-exec` predicate vanishes from the judgment view. Code execution.
• CVE-2026-87986 (10.0, CWE-228): Unreadable syntax is hung on an error node. Unparsed fragments are not checked. The command still runs.
• CVE-2026-87987 (10.0, CWE-15): Environment-variable assignments prefixed to a command are stripped at judgment time. Prefix an allowlisted command with assignments; the check sees only the command, the shell runs the full environment.
• CVE-2026-87988 (10.0, CWE-732): 31 auto-approved commands are missing from the path-validation list. Some of them can write files via their own arguments.

Impact Assessment

CVSS 4.0 vector: `AV:N/AC:L/AT:N/PR:N/UI:N`. No privileges, no interaction. Real risk depends on what the agent can reach: if induced to process a malicious repo, issue, or prompt-injection payload, the attacker runs commands as the Vibe account on the dev machine — source, cloud credentials, SSH private keys. None of the six require prompt jailbreaks. Ordinary code defects skip the last user-confirmation gate on whether execution is allowed.

Remediation

As of writing, the vendor has not shipped a unified fixed release. Official advisory and HiddenLayer guidance remain mitigation-first:

• Disable auto-approve. Confirm every command. If you cannot confirm per-command, pause deployment or run it in a throwaway container.
• Run Vibe as a least-privilege account. Deny access to production credentials, cloud keys, and SSH private-key directories.
• Do not feed unknown repos or archives to the agent. Inspect scripts and configs first.
• Track mistral-vibe via pip or uv. Upgrade to a patched release as soon as it ships.
• Audit subprocesses spawned by the agent process. Watch `find -exec` and prefix env-var assignments.

References

• Six permission bypasses in Mistral Vibe
• CVE Record: CVE-2026-87987
• OffSeq Threat Radar: CVE-2026-87986
• HiddenLayer SAI Security Advisory 2026-09