CVE-2026-87987: Mistral Vibe vulnerability
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to submit to exploit this issue?
The attacker needs to use environment variable assignments placed before an allowlisted command. Because those assignments are excluded from permission inspection, attacker-controlled variables can lead to arbitrary code execution without user approval.
What activity should be investigated as a possible exploitation attempt?
Review uses of allowlisted commands that are preceded by environment variable assignments. These assignments are the mechanism identified for bypassing command permission checks.