Mistral Vibe CVE-2026-109429

Requires Mistral Vibe before 2.25.4 running with its command permission gate (allowlist) active - the very control being bypassed. The attacker must get attacker-controlled input processed by the agent (UI:P), typically through prompt injection in untrusted files, repositories, web content, or tool output that the agent converts into a shell command. The malicious string must end with an allowlisted command so tree-sitter-bash static classification approves it, while a command substitution is concealed inside a single-quoted variable value and re-expanded using the bash ${var@P} prompt-transform operator. Execution depends on bash's promptvars feature being active to expand the prompt transform at runtime. Limiting factors: an operator must actually be running an agent session against the attacker's content, a bash shell is required, and non-patched (pre-2.25.4) versions only; there is no need for the attacker to hold any account or privilege on the target (PR:N).

This is a high-severity but conditionally-exploitable issue rather than a mass-exploitation priority. The provided CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:P) indicates a remotely-reachable, low-complexity, no-privilege flaw with full confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) and no scope change to subsequent systems (SC/SI/SA:N). The single most important moderating signal is UI:P (passive user interaction): exploitation is not autonomous - it requires an operator to be running a Mistral Vibe agent session that processes attacker-controlled input, which the agent then turns into a gated shell command. No EPSS score was provided, so statistical exploitation probability cannot be stated. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation; status is 'no public exploit identified at time of analysis' (a detailed VulnCheck technical advisory describes the technique, but a working POC is not flagged in the input - do not conflate advisory detail with available exploit code). CWE-436 (interpretation conflict) is an accurate root cause: tree-sitter-bash static analysis classifies the command differently than bash classifies it at runtime. Net assessment: genuinely dangerous for anyone running affected Mistral Vibe who feeds it untrusted content (repos, documents, web/tool output), but the UI:P requirement and the niche deployment footprint place it below internet-wide worm-grade threats. A patched version exists, making remediation straightforward.

An attacker plants a crafted shell string - via prompt injection in an untrusted file, repository, web page, or tool output that the Mistral Vibe agent processes - that embeds a command substitution inside a single-quoted variable and re-expands it with bash's ${var@P} prompt-transform operator. Because tree-sitter-bash static parsing only sees and approves the trailing allowlisted command, the permission gate lets it through, and at runtime bash's promptvars feature silently executes the hidden command with the privileges of the agent's terminal session. No public exploit is identified in the input, though VulnCheck has published a technical advisory; the AV:N/AC:L profile makes reliable exploitation plausible once an attacker can get content in front of the agent (UI:P).