EUVD-2026-76118
GHSA-wcxh-p9m4-jq8r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply malicious repo/prompt to agent
-
DeliveryInduce allowlisted command with quoted absolute path
-
ExploitQuoting defeats workspace path validation
-
ExecutionAgent reads out-of-workspace file unapproved
-
ImpactSensitive file contents disclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a running Mistral Vibe instance (version 2.6.0 or later) configured with its shell-command allowlist and automatic approval, and an attacker able to influence what command the agent executes - typically via a malicious repository, prompt, or task the agent processes. The specific trigger is a quoted absolute path inside an otherwise allowlisted shell command, which the path-validation routine fails to reject. Exploitation is limited to reading files the Vibe process can access; it yields no write/integrity or availability impact, and it is moot if the agent runs in a filesystem-confined sandbox or if auto-approval of allowlisted commands is disabled. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, 9.2) models an unauthenticated, low-complexity, high-confidentiality issue with a subsequent-system (scope) impact reflecting the escape beyond the workspace boundary. That rating is plausible for the disclosure impact, but the PR:N/UI:N framing deserves scrutiny: practical exploitation requires the Vibe agent to be running and to process attacker-influenced input (a malicious repository, prompt, or task) that induces it to invoke the crafted allowlisted command, which is closer to an attacker-supplied-content scenario than to direct network attack on a service. Confidentiality-only impact (no integrity/availability) is consistent with a read primitive. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active or automatable mass exploitation; treat this as a real but targeted/agent-context risk rather than a wormable internet-facing flaw. Key uncertainty: the attack vector may be better characterized as local/content-driven than AV:N - verify against the HiddenLayer advisory. |
| Exploit ScenarioDerived | A developer opens an untrusted project (or pastes an attacker-crafted task) in Mistral Vibe; the input steers the agent to run an allowlisted shell command containing a quoted absolute path such as cat "/home/victim/.ssh/id_rsa". Because the quoted path defeats workspace validation and the command is allowlisted, the agent reads the file and returns its contents without asking for approval, exfiltrating secrets outside the workspace. No public POC is referenced, but HiddenLayer documents the quoting bypass technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
RemediationAI
No vendor-released patch identified at time of analysis; the only cited source is the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe), so monitor Mistral AI release notes and upgrade to a fixed release as soon as one is published for versions at or after 2.6.0. As compensating controls until a patch is confirmed: run Mistral Vibe under a dedicated low-privilege account or container whose filesystem view is limited to the workspace (mount only the project directory, drop read access to home directory, SSH keys, and credential stores), which neutralizes the read primitive at the OS layer at the cost of losing access to files the agent legitimately needs; tighten or disable auto-approval of allowlisted shell commands so path-bearing commands require explicit user confirmation, trading convenience for safety; and avoid running the agent against untrusted repositories or prompts that could supply the crafted quoted-path command.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mistral Vibe (CPE cpe:2.3:a:mistralai:mistral-vibe) is an AI coding agent that executes shell commands on a developer's behalf, gating sensitive actions behind a command allowlist and a workspace boundary that should confine file access to the active project directory. The root cause is a classic CWE-22 path-traversal/sandbox-escape: the path-validation logic that enforces the workspace boundary does not correctly account for shell quoting, so an absolute path wrapped in quotes is not normalized or rejected as out-of-workspace. Because the command itself is on the allowlist, the agent runs it automatically without prompting the user, turning a validation gap into silent, unapproved disclosure of files anywhere the process can read (e.g., /etc/passwd, SSH keys, credentials outside the project).
Know when Mistral Vibe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Read-only disclosure (C:H, I/A:N) escaping the workspace boundary is a scope change (S:C); exploitation needs the agent to process attacker-supplied content, so UI:R rather than UI:N.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
DescriptionCVE.org
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.
Executive ViewAI
Mistral Vibe (Mistral AI's agentic coding assistant) version 2.6.0 and later contains a critical path-validation flaw that enables arbitrary file read outside the tool's sandbox, risking exposure of source code, credentials, and sensitive documentation. No vendor patch is currently available, creating immediate operational risk for development teams using this tool on systems containing sensitive data.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Mistral Vibe to isolated, air-gapped environments; implement file system access controls to limit agent read scope to designated non-sensitive directories only; disable or suspend Mistral Vibe usage until patch availability is confirmed; implement continuous monitoring of file access logs for anomalous read patterns; consider operational suspension of Mistral Vibe across the organization pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mistral Vibe
View allArbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially mod
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval a
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping mali
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or over
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell com
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileg
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim
Exploit-DB