Mistral Vibe CVE-2026-87987

Requires the target to be running Mistral Vibe with its command permission/allowlist check as the execution gate, and an attacker able to influence a command the agent proposes to execute (e.g. via injected/processed content). The specific enabler is that environment-variable assignments (VAR=value) placed before an allowlisted command are excluded from inspection, so the exploit only works when at least one allowlisted command exists and the shell honors the inline env-var prefix. Limiting factors: the agent must actually reach command execution, and hardened setups that require full-command-line approval, disable auto-run, or scrub environment variables neutralize it. The input's AV:N/PR:N/UI:N should be verified, since real-world triggering depends on how attacker input reaches the agent.

The input CVSS 4.0 vector is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA and subsequent-system impact), which reads as trivially exploitable and total compromise. That score is likely overstated for an agentic-tool config bypass: real exploitation depends on an attacker being able to influence what command the agent proposes to run (for example via prompt injection in processed content, a malicious repository, or tool output), and on the agent actually reaching the point of executing an allowlisted command. There is no EPSS score, no KEV listing, and no explicit POC in the provided data, so widespread automated exploitation is not evidenced. The signal is a single credible vendor/research advisory (HiddenLayer). Net: a genuinely serious bypass for anyone running Mistral Vibe with command allowlisting as their safety boundary, but the 10.0 rating overstates conditions - treat as high priority for affected users rather than an internet-wide worm risk, and note the AV:N/PR:N/UI:N claim should be verified against how attacker input reaches the agent.

An attacker seeds content the agent will process - a malicious file, repo, or web page - that steers Mistral Vibe into proposing a command like 'LD_PRELOAD=/tmp/evil.so ls', which the allowlist approves because only 'ls' is checked. When the agent runs it, the attacker's shared object loads and executes with the agent user's privileges, achieving code execution with no explicit user approval. No public POC is confirmed in the provided data, but the technique is straightforward for anyone able to influence the agent's proposed commands.