Mistral Vibe
Monthly
Arbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially modify) files outside the intended workspace by abusing commands the agent treats as unconditionally allowed. Because these allowlisted commands skip path validation, the agent executes them against arbitrary filesystem paths without prompting for user approval, breaking the workspace sandbox boundary. Reported by HiddenLayer; no public exploit identified at time of analysis, and no EPSS/KEV data provided.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.
Arbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially modify) files outside the intended workspace by abusing commands the agent treats as unconditionally allowed. Because these allowlisted commands skip path validation, the agent executes them against arbitrary filesystem paths without prompting for user approval, breaking the workspace sandbox boundary. Reported by HiddenLayer; no public exploit identified at time of analysis, and no EPSS/KEV data provided.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.