CVE-2026-87988: Mistral Vibe vulnerability
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker needs to cause Mistral Vibe to use commands classified as unconditionally allowed with paths outside the active workspace. Those commands lack path validation, allowing workspace restrictions to be bypassed without user approval.
What data could be exposed?
Files outside the active workspace may be accessible through the affected commands. The provided information does not identify specific file locations or permission boundaries.
Are users protected by workspace restrictions or approval prompts?
No. The vulnerability bypasses workspace restrictions and permits the out-of-workspace file access without user approval when the affected command classification is used.