Critical severity · published Sep 11, 2026
CVE-2026-87986
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistral-vibe · mistralai
1.3.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87986
www.hiddenlayer.com
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4
More from mistral-vibe
10.0
CVE-2026-87988
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed
10.0
CVE-2026-87987
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted…
10.0
CVE-2026-87985
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments
9.3
CVE-2026-87984
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user…
9.2
CVE-2026-87983
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted…