Mistral Vibe
Monthly
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted repository: a crafted .git/config defines Git filter drivers and .gitattributes binds them to files, so git worktree add runs smudge, clean, or process commands before Vibe's trusted-folder check. The commands execute with the invoking user's privileges, and exploitation requires the user to add the malicious repository in worktree mode. The vendor released 3.0.3; no public exploit was identified at time of analysis and EPSS is 0.43% (37th percentile).
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell command execution with the privileges of the agent's terminal session, while the allowlist gate reports that only a trailing, allowlisted command was run. The bypass hides a command substitution inside a single-quoted variable value that the agent's tree-sitter-bash static parser cannot see, then triggers execution at runtime through bash's ${var@P} prompt-transform operator; the vendor has fixed the misclassification in 2.25.4. Exploitation is conditional rather than opportunistic - an operator must be running an agent session over attacker-controlled content (prompt injection in untrusted files, repositories, web content, or tool output) and a bash shell with promptvars enabled must be in use - and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front of the agent to have arbitrary shell commands executed under the user's own privileges, despite the tool's command allowlist. The flaw is a parser disagreement: tree-sitter-bash truncates a backslash-newline continuation and sees only an allowlisted prefix such as 'cd', while bash joins the lines and runs a materially different command (for example a curl request), so resolve_permission grants ALWAYS for the benign-looking prefix and the hidden command executes. Exploitation requires the allowlist / auto-approval mechanism to be in use and requires the user to direct the agent at malicious input (UI:P per the CVSS 4.0 vector, UI:R in the CVSS 3.1 assessment), so it is not fully autonomous, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 2.25.5.
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileges of the user running the tool, because worktree creation executes a repository's own git hooks - notably the post-checkout hook and the fsmonitor command - before any workspace trust validation takes place. The attack requires the victim to deliberately open, clone, or check out an attacker-controlled repository (user interaction is mandatory, and the request itself is unauthenticated per the CVSS PR:N vector), and code execution is bounded by the permissions of the Vibe user, with no privilege escalation or server-side attack surface. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited; a vendor-released patch in 2.25.5 addresses the ordering bug.
Arbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially modify) files outside the intended workspace by abusing commands the agent treats as unconditionally allowed. Because these allowlisted commands skip path validation, the agent executes them against arbitrary filesystem paths without prompting for user approval, breaking the workspace sandbox boundary. Reported by HiddenLayer; no public exploit identified at time of analysis, and no EPSS/KEV data provided.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted repository: a crafted .git/config defines Git filter drivers and .gitattributes binds them to files, so git worktree add runs smudge, clean, or process commands before Vibe's trusted-folder check. The commands execute with the invoking user's privileges, and exploitation requires the user to add the malicious repository in worktree mode. The vendor released 3.0.3; no public exploit was identified at time of analysis and EPSS is 0.43% (37th percentile).
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell command execution with the privileges of the agent's terminal session, while the allowlist gate reports that only a trailing, allowlisted command was run. The bypass hides a command substitution inside a single-quoted variable value that the agent's tree-sitter-bash static parser cannot see, then triggers execution at runtime through bash's ${var@P} prompt-transform operator; the vendor has fixed the misclassification in 2.25.4. Exploitation is conditional rather than opportunistic - an operator must be running an agent session over attacker-controlled content (prompt injection in untrusted files, repositories, web content, or tool output) and a bash shell with promptvars enabled must be in use - and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front of the agent to have arbitrary shell commands executed under the user's own privileges, despite the tool's command allowlist. The flaw is a parser disagreement: tree-sitter-bash truncates a backslash-newline continuation and sees only an allowlisted prefix such as 'cd', while bash joins the lines and runs a materially different command (for example a curl request), so resolve_permission grants ALWAYS for the benign-looking prefix and the hidden command executes. Exploitation requires the allowlist / auto-approval mechanism to be in use and requires the user to direct the agent at malicious input (UI:P per the CVSS 4.0 vector, UI:R in the CVSS 3.1 assessment), so it is not fully autonomous, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 2.25.5.
Remote code execution in Mistral Vibe before 2.25.5 allows an attacker to run arbitrary shell commands with the privileges of the user running the tool, because worktree creation executes a repository's own git hooks - notably the post-checkout hook and the fsmonitor command - before any workspace trust validation takes place. The attack requires the victim to deliberately open, clone, or check out an attacker-controlled repository (user interaction is mandatory, and the request itself is unauthenticated per the CVSS PR:N vector), and code execution is bounded by the permissions of the Vibe user, with no privilege escalation or server-side attack surface. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited; a vendor-released patch in 2.25.5 addresses the ordering bug.
Arbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially modify) files outside the intended workspace by abusing commands the agent treats as unconditionally allowed. Because these allowlisted commands skip path validation, the agent executes them against arbitrary filesystem paths without prompting for user approval, breaking the workspace sandbox boundary. Reported by HiddenLayer; no public exploit identified at time of analysis, and no EPSS/KEV data provided.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.