EUVD-2026-76118
GHSA-wcxh-p9m4-jq8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Read-only disclosure (C:H, I/A:N) escaping the workspace boundary is a scope change (S:C); exploitation needs the agent to process attacker-supplied content, so UI:R rather than UI:N.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
Lifecycle Timeline
2DescriptionCVE.org
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.
AnalysisAI
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running Mistral Vibe instance (version 2.6.0 or later) configured with its shell-command allowlist and automatic approval, and an attacker able to influence what command the agent executes - typically via a malicious repository, prompt, or task the agent processes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, 9.2) models an unauthenticated, low-complexity, high-confidentiality issue with a subsequent-system (scope) impact reflecting the escape beyond the workspace boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the only cited source is the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe), so monitor Mistral AI release notes and upgrade to a fixed release as soon as one is published for versions at or after 2.6.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Mistral Vibe deployments to identify affected versions (2.6.0+) and document data exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mistral Vibe
View allArbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially mod
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval a
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping mali
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or over
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today