CVE-2026-87984: Path Traversal
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mistral Vibeto a version that resolves this vulnerability.Fixed in 1.3.4 - Compensating control
Restrict the filesystem permissions/OS-level access of the Vibe process so it cannot write to arbitrary paths outside the active workspace.
Event History
Frequently Asked Questions
What does an attacker need in order to exploit this issue?
The attacker needs a way to cause Mistral Vibe to run an otherwise allowlisted command with shell output redirection. The redirection destination can then target paths outside the active workspace that are accessible to the Vibe process.
What is the practical impact of successful exploitation?
An attacker can create or overwrite files outside the active workspace without user approval. The scope of impact is limited by the filesystem permissions of the process running Mistral Vibe.
Are allowlisted commands sufficient to prevent this behavior?
No. The issue occurs because shell redirection destinations are omitted from permission checks, so a command may be allowlisted while its redirected output path is not validated.