CVE-2026-87987: An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using e

A security vulnerability in Mistral Vibe allows attackers to run unauthorized code by sneaking environment variable assignments (settings that control how programs behave) before allowlisted commands, which bypasses the permission checks that normally prevent this. The vulnerability works because these environment variable assignments are not inspected for safety before the command runs.