Mistral Vibe CVE-2026-87988

Requires that the victim is running Mistral Vibe and that the agent is induced to execute one of the commands classified as 'unconditionally allowed' - these are the exact commands that skip path validation; operations gated by normal approval or path checks are not affected. Exploitation is limited by the need for the agent to actually process attacker-influenced input (e.g. a malicious repository, file, or prompt) and by whatever filesystem privileges the Vibe process holds, since it can only reach files that process can read. No separate authentication step is described, but the attack is gated on the target choosing to run the agent against the attacker's content.

The assigned CVSS 4.0 base score is 10.0 (AV:N/AC:L/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA all High), but several signals warrant scrutiny. The subsequent-system High impacts (SC:H/SI:H/SA:H) appear overstated: the described effect is reading/accessing files outside the workspace on the host where the agent runs, not a demonstrated cross-system scope change. The PR:N/UI:N combination is plausible only if the trigger arrives as attacker-controlled content the agent processes automatically (the 'without user approval' path), which is the realistic delivery vector for an agentic tool. There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so this is a high-severity design weakness rather than confirmed widespread exploitation. Any team running Vibe against untrusted repositories or prompts should treat workspace-escape file access as a priority, because the agent acts autonomously, but the real-world blast radius depends heavily on what the agent process can read on disk and is best confirmed against the HiddenLayer advisory and vendor guidance.

An attacker seeds a repository, issue, or prompt with content that steers Mistral Vibe into invoking an allowlisted command whose target path lies outside the workspace (e.g. a home-directory SSH key or credentials file). Because the command is unconditionally allowed and its path is never validated, the agent reads the file without asking the user, exfiltrating secrets into the session output. No public exploit code is identified at time of analysis.