Critical severity · published Sep 11, 2026
CVE-2026-87988
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed
10.0
CVSS
0.4%
EPSS
No
On KEV
Description
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistral-vibe · mistralai
2.15.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87988
www.hiddenlayer.com
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe6
More from mistral-vibe
10.0
CVE-2026-87987
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted…
10.0
CVE-2026-87986
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret
10.0
CVE-2026-87985
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments
9.3
CVE-2026-87984
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user…
9.2
CVE-2026-87983
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted…