Mistral Vibe CVE-2026-87984

Exploitation requires that the attacker can influence a command the Vibe agent executes and that the command is on Vibe's allowlist (or otherwise auto-approved), then append a shell redirection whose destination lies outside the active workspace. The write is bounded by the filesystem permissions of the Vibe process, so impact scales with how privileged the account running Vibe is. Limiting factors: the target must actually be running Mistral Vibe 1.3.4 or later, the agent must process attacker-influenced instructions or content, and only paths the Vibe process can already access are writable - there is no privilege escalation on the host beyond the agent's own rights.

The vendor CVSS 4.0 score is 9.3 with vector AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, which maps the impact as high across confidentiality, integrity, and availability. That confidentiality rating is arguably overstated: a redirection-based file-write primitive is fundamentally an integrity/availability issue (overwriting configs, scripts, or startup files), and confidentiality exposure is at best indirect. The more important nuance is the attacker model - this is a local agent, so 'unauthenticated network' realistically translates to untrusted content or instructions reaching the agent (e.g. a poisoned repository, dependency, or task prompt) rather than a directly internet-facing service; whoever is triaging this, whether a large enterprise or a mid-sized operator, should still treat arbitrary out-of-workspace writes as a plausible path to code execution and prioritize the upgrade. No EPSS score, KEV entry, or SSVC decision data was provided, and no public exploit code is identified; the single HiddenLayer advisory is the only source, so severity rests on the described primitive rather than observed exploitation. Overall this is a genuine escape-the-sandbox concern for anyone running Vibe against untrusted inputs, but real-world blast radius depends heavily on how exposed the agent is to attacker-influenced instructions.

An attacker seeds a repository or task with instructions that cause Vibe to run an allowlisted command with an appended shell redirection, e.g. writing generated content to '~/.bashrc', a CI script, or an SSH authorized_keys file outside the workspace. Because the redirection target bypasses the approval prompt, the file is created or overwritten silently, and on the next shell login or pipeline run the planted content executes with the user's privileges. No public exploit code is currently identified, but the technique is straightforward given the described root cause.