CVE-2026-87985: Mistral Mistral Vibe vulnerability
Published Sep 11, 2026
·Updated
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
Affected Software
1 affected component
Mistral Mistral Vibe
Event History
Sep 11, 2026
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
Deployments using Mistral Vibe command permission checks with allowlisted commands are exposed if those checks can be reached with attacker-controlled command arguments.
2
What does an attacker need to exploit the vulnerability?
The attacker needs to supply a crafted allowlisted command using ANSI-C quoted arguments. Those arguments are not properly inspected, allowing the permission checks to be bypassed and arbitrary code to run without user approval.