EUVD-2026-76120
GHSA-8555-f52w-mpcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant crafted content in untrusted repo/input
-
DeliveryVictim runs Mistral Vibe on it
-
ExploitAgent issues allowlisted command with ANSI-C quoted payload
-
ExecutionPermission check inspects raw string, approves
-
PersistShell expands quotes, executes arbitrary code
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Requires the victim to be running Mistral Vibe with its command-permission allowlist active, and the attacker to get a crafted allowlisted command containing ANSI-C quoted ($'...') arguments in front of the agent - typically via untrusted content the agent processes (a malicious repository, file, or injected prompt). The bypass specifically defeats the approval step, so no user approval is needed for the malicious command, but exploitation is limited by the requirement that the tool be in use and pointed at attacker-influenced input; it is not an exploit against an exposed network service. Platforms with a shell that honors ANSI-C quoting (Unix-like/bash) are the relevant target environment. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and full subsequent-system impact) yields a maximal 10.0, reflecting complete host compromise once the bypass fires. However, real-world risk is more nuanced than the raw score: exploitation depends on the victim actively running Mistral Vibe and the agent processing attacker-influenced content (e.g., a crafted repository, file, or prompt-injected instruction) so the malicious allowlisted command reaches the approval layer. There is no KEV listing and no POC flagged in the input, so this is not confirmed active exploitation - it is a credible, well-documented technique from a reputable research firm (HiddenLayer). EPSS is not provided. The UI:N/PR:N metrics are defensible for a prompt-injection-style delivery but assume the attacker can get content in front of the agent; defenders should treat this as high-priority for anyone deploying the tool while recognizing exploitation is gated on tool usage rather than being an internet-facing service exposure. |
| Exploit ScenarioDerived | An attacker plants a crafted file, README, or code comment in a repository the victim opens with Mistral Vibe, containing an instruction that induces the agent to run an allowlisted command whose arguments hide a payload in ANSI-C $'...' quoting. The permission checker sees a benign allowlisted command and skips the approval prompt, but the shell expands the quoted escape sequences and executes the attacker's code on the user's system. HiddenLayer documents the bypass technique in its advisory; no separate weaponized POC is confirmed in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
RemediationAI
No vendor-released patch version is identified in the available data - consult the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3) and Mistral AI channels for an updated release and upgrade to it as the primary fix once published. As compensating controls until a patched version is confirmed: run Mistral Vibe only against trusted repositories and inputs to reduce the chance the agent processes attacker-controlled commands; disable or tighten the command-execution/auto-approval feature so shell commands require explicit manual review rather than allowlist auto-approval (trade-off: reduces agent autonomy and convenience); and run the tool inside a sandboxed or containerized environment with minimal privileges and no sensitive credentials so that a successful bypass cannot reach the broader host (trade-off: added setup overhead). Avoid relying on the built-in allowlist as a security boundary while the ANSI-C quoting gap is unpatched.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mistral Vibe (CPE cpe:2.3:a:mistralai:mistral-vibe) is an AI coding/agent tool that gates shell command execution behind a permission allowlist so users can approve or deny commands the model wants to run. The root cause maps to CWE-184 (Incomplete List of Disallowed Inputs): the allowlist/permission logic parses command arguments incompletely and does not account for shell ANSI-C quoting semantics ($'...'), where escape sequences are expanded by the shell after the checker has already inspected the raw string. An allowlisted-looking command can therefore carry embedded, obfuscated payloads that the checker treats as benign but the shell interprets as arbitrary code, defeating the human-in-the-loop approval barrier that is the tool's core safety control.
Know when Mistral Vibe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Delivery via attacker-controlled content the agent processes implies user interaction (UI:R); the bypass escapes the app's permission sandbox to run host code, so scope changes with full C/I/A impact.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
DescriptionCVE.org
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
Executive ViewAI
Mistral Vibe, an AI coding agent, contains a critical arbitrary code execution vulnerability (CVSS 10.0) with no public exploit identified at time of analysis. Users can be manipulated into running attacker-supplied commands that bypass the built-in approval system, potentially compromising developer environments, enabling intellectual property theft, and facilitating code injection attacks. No patch is currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restricting Mistral Vibe to isolated or sandboxed development environments disconnected from production systems; (2) disabling command execution features where feasible, or requiring explicit manual code review and approval before executing tool-suggested commands; (3) implementing monitoring for suspicious process execution from development terminals and IDEs; (4) conducting security awareness training for developers on social engineering techniques and command-bypass methods; (5) maintaining enhanced logging of all tool-assisted code execution to enable rapid incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Mistral Vibe
View allArbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially mod
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval a
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or over
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell com
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileg
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim
Exploit-DB