Mistral Vibe (Mistral's agentic coding CLI): six shell-permission-check bypasses let an allowlisted command run attacker-chosen code or reach files outside the workspace without an approval prompt — CVE-2026-87983 through CVE-2026-87988, four scored CVSS 10.0, reachable through indirect prompt injection; HiddenLayer disclosed 2026-09-11, Mistral fixed in 2.25.4 (recommends 2.25.8+)

View raw markdownEdit on GitHub ↗

TL;DR

Mistral Vibe, Mistral's agentic coding CLI, had its command-approval check bypassed six ways: the parser that decides whether a command needs a human "allow" prompt did not understand shell redirection, ANSI-C quoting, environment-variable prefixes, quoted absolute paths, or several other constructs — so an allowlisted command could run attacker-chosen code or read and write files outside the workspace without a prompt. Because a coding agent can be steered by indirect prompt injection in the content it processes, hostile text in a repo, issue or web page could invoke these. HiddenLayer disclosed them on 2026-09-11 as CVE-2026-87983 through CVE-2026-87988 (four scored CVSS 10.0); Mistral shipped the structural fix in 2.25.4 on 2026-09-12 and now recommends 2.25.8 or later.

What happened

HiddenLayer's Esteban Tonglet reported a family of permission-check gaps in Mistral Vibe's shell handling. The check reconstructs a command to decide whether it is on the auto-approve allowlist, but its reconstruction dropped whole classes of shell syntax, and the shell then executed the parts the check never saw:

CVE Bypass Affected Fixed CVSS 4.0
CVE-2026-87983 Quoted absolute paths skip path checks 2.6.0 → 2.19.1 2.19.1 —
CVE-2026-87984 Shell redirection targets not checked (arbitrary file write) 1.3.4 → 2.25.4 2.25.4 9.3
CVE-2026-87985 ANSI-C quoted arguments not exposed to the parser 2.9.0 → 2.25.4 2.25.4 10.0
CVE-2026-87986 Incomplete command parsing (unparsed portions omitted) 1.3.4 → 2.25.4 2.25.4 10.0
CVE-2026-87987 Environment-variable prefixes stripped before the check 2.6.0 → 2.25.4 2.25.4 10.0
CVE-2026-87988 Allowlist and path-validation gaps (command-option bypasses) 2.15.0 → 2.25.4 2.25.4 10.0

The practical impact, per Mistral's advisory MAI-2026-003, is that an unapproved command could read files outside the workspace (credentials, source), create or overwrite files outside it, or run code as the user — and the vector that makes it matter for a coding agent is indirect prompt injection, since the hostile command rides in on content the agent processes and uses an ordinary-looking program name. Independent researcher SecMate reported overlapping issues to Mistral on 2026-09-05; HiddenLayer published 2026-09-11 (Mistral says without pre-notification); Mistral learned of the CVEs on 2026-09-12, shipped 2.25.4 the same day folding in earlier partial fixes (path checks added to the legacy shell in 2.20.0, extended to the managed shell in 2.23.0), and published MAI-2026-003 on 2026-09-14. The vendor recommends 2.25.8+; the current PyPI release is 2.26.0. This is the same approval-bypass shape as the Cursor, Claude Code and VTCode find/allowlist bypasses already in this corpus — the check is a parser, and the shell is a more capable parser than the check.

Am I affected?

pip show mistral-vibe 2>/dev/null | grep -i version   # < 2.25.4 is affected; upgrade to 2.25.8+
vibe --version 2>/dev/null

Any Mistral Vibe below 2.25.4 is exposed. An affected version means exposure, not compromise — redirections, env assignments and quoted arguments all appear in legitimate commands, so their presence is not evidence of exploitation.

If you are affected

Upgrade to 2.25.8 or later and restart running sessions. Keep permission checks on; auto-approve ("YOLO") modes bypass these controls entirely. If you find unauthorised command activity, preserve evidence and rotate credentials the agent could reach — see if-your-local-ai-agent-was-exploited.md and agent-sandboxing.md.

Prevention

Treat a coding agent's command-allowlist as a parser that will be out-parsed, and sandbox the agent rather than relying on it (agent-sandboxing.md); keep untrusted repos, issues and pages from driving an agent in auto-approve mode (mcp-hygiene.md).

Update 2026-10-13: a seventh bypass, CVE-2026-109429, same fix release

VulnCheck published CVE-2026-109429 on 2026-10-13 (CNA VulnCheck, CVSS 4.0 8.7, CVSS 3.1 8.8, CWE-436, credit Minqiang Gui) for Mistral Vibe before 2.25.4. The record describes a command permission gate bypass of the same family as the six above: a command substitution hidden inside a single-quoted variable value is invisible to the tree-sitter-bash static parse, and bash's ${var@P} prompt-transform operator re-expands it at run time, so only the trailing allowlisted command is classified and the hidden one runs with the agent's terminal privileges. The record's references are the v2.25.4 release, pull request #1084 and its commit; the release PR was merged on 2026-09-12 and describes "shell-permission security fixes recorded in CHANGELOG.md" without naming this id, and the release notes link five HiddenLayer ids, CVE-2026-87984 through CVE-2026-87988, only (CVE-2026-87983 was fixed earlier, in 2.19.1). So the fix version is the one already stated in this file, the id is new, and Mistral's MAI-2026-003 (read again on 2026-10-14) still lists six. The record arrived through the advisory database's agent listing; no search engine returned the id on the day. PyPI's current release is 2.26.1 (checked 2026-10-14). Nothing changes for a reader on 2.25.8 or later.

Sources