CVE-2026-109428: Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolvepermission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistral Vibeto a version that resolves this vulnerability.Fixed in 2.25.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Mistral Vibe versions before 2.25.5 are affected. The issue applies where its Bash command permission validation is used, because the vulnerable _extract_commands() logic can disagree with how Bash ultimately interprets a command.
What does an attacker need to exploit this?
An attacker needs to be able to submit or influence a Bash command string that reaches the permission-validation flow. No authentication privileges are required according to the provided vector, but exploitation requires user interaction.
How does the permission bypass work?
The attacker uses a backslash-newline continuation so tree-sitter-bash recognizes an allowlisted command prefix, such as cd, while Bash joins the lines and executes a different hidden command. This can cause resolve_permission to grant ALWAYS permission for a command that Bash interprets as an unauthorized arbitrary command.
How can the issue be remediated?
Upgrade Mistral Vibe to version 2.25.5 or later. The provided references identify the 2.25.5 release and its associated fix.