Mistral Vibe EUVD-2026-99221

Requires that Mistral Vibe's command-permission allowlist be in use (the mechanism abused is resolve_permission granting ALWAYS to an allowlisted prefix such as 'cd') and that the agent processes an attacker-crafted command string containing a backslash-newline line continuation, where tree-sitter-bash and bash disagree on the joined result. The principal limiting factor is UI:P - a user must run the agent against the malicious input (typically delivered as untrusted content the agent is directed to handle), so exploitation is not fully autonomous. Affected only in versions before 2.25.5; no elevated privileges or prior authentication on the host are needed (PR:N).

This is a genuine priority within its (niche) deployment footprint rather than a CVSS-inflated non-issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 8.7) indicates a low-complexity, no-privilege attack with high confidentiality, integrity, and availability impact, limited only by passive user interaction (UI:P). The root cause (CWE-436, interpretation conflict) is credible and well-documented: a parsing divergence between tree-sitter-bash and bash lets an attacker defeat the command-allowlisting control that is the product's core security boundary. However, risk signals are mixed and incomplete: there is NO CISA KEV listing and NO public proof-of-concept referenced, so exploitation is not confirmed in the wild - no public exploit identified at time of analysis. EPSS and SSVC (exploitation status, automatable, technical impact) values were NOT provided in the input and cannot be inferred; this is a material gap for prioritization. The flaw was reported by VulnCheck (a credible research org) and a vendor patch exists (v2.25.5, PR #1111, commit c069ffa), which raises confidence in the technical details even absent active-exploitation evidence. Net: high technical severity and a fully-disclosed, patched mechanism, but no evidence of active exploitation and a limited real-world install base - treat as high-priority to patch for Mistral Vibe operators, lower-priority at fleet scale given product prevalence.

An attacker plants a crafted command string (e.g., within untrusted content the agent is asked to process, such as a repository file, web page, or task instruction) that begins with an allowlisted prefix like 'cd' followed by a backslash-newline continuation hiding a curl request. When the victim runs Mistral Vibe and it evaluates the command, tree-sitter-bash sees only the approved 'cd' and resolve_permission grants ALWAYS, while bash joins the continuation and executes the hidden arbitrary command. No public exploit code is referenced, but the mechanism is fully described in the VulnCheck advisory and vendor commit.