CVE-2026-87983: Path Traversal
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.
Affected Software
Event History
Frequently Asked Questions
Does user approval prevent access to files outside the active workspace?
No. The vulnerability allows files outside the active workspace to be read without user approval when quoted absolute paths are used in allowlisted shell commands.
What attacker-controlled input is required to exploit this issue?
The attacker needs to use a quoted absolute path in an allowlisted shell command. The quoted path can bypass the workspace path-validation restrictions.
Which version introduced the vulnerability?
The issue was introduced in Mistral Vibe version 2.6.0. The provided information does not identify a fixed version or the full affected version range.