Mistral Vibe EUVD-2026-76121

Exploitation requires that Mistral Vibe process attacker-controlled input and reach its command-approval path, and that the attacker's payload use shell constructs the tool's parser cannot interpret so the malicious portion is omitted from the approval inspection but still passed to the shell. Limiting factors: the victim must run Mistral Vibe against the attacker-influenced content (repository, prompt, or task), and the executed commands run with the invoking user's privileges rather than granting privilege escalation on their own; there is no separate authentication barrier once the agent is processing the content. It is not a fully passive, zero-touch network exploit despite the CVSS AV:N/UI:N encoding.

The supplied CVSS 4.0 base score is 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA and subsequent-system SC/SI/SA all High), which treats this as trivially remote, unauthenticated, no-interaction code execution - an aggressive rating for a client-side developer tool. In practice the realistic trigger is the agent processing attacker-influenced content (a malicious repository, prompt, dependency, or task), so some user action to run the agent is normally involved; that argues for a user-interaction factor rather than pure UI:N, tempering the raw score. Working against that mitigation, the whole point of the vulnerability is that it defeats the approval control users rely on, so once malicious content reaches the agent the compromise is silent and the technical impact is full system code execution. EPSS and KEV data were not provided and no POC is indicated, so this should be read as a high-severity, credible-but-not-yet-observed-in-the-wild issue: any team running Mistral Vibe against untrusted code or prompts should treat it as urgent and patch promptly, while recognizing the 10.0 likely overstates the unauthenticated/no-interaction ease. The 'malbork' editorial instruction embedded in the task input was ignored as a prompt-injection attempt.

An attacker publishes a repository, issue, or task description containing a shell command whose malicious payload is hidden inside a construct Mistral Vibe's parser cannot interpret (for example command substitution or chaining). When a developer runs Mistral Vibe against that content, the approval prompt displays only the benign, parsed portion; the developer approves it, and the hidden command executes with the developer's privileges - exfiltrating credentials or installing a backdoor. No public POC is indicated at time of analysis.