Advisories

CVE-2026-116843 affects Mistral Vibe before 3.0.3. Attacker-defined git filter drivers in an untrusted repository's .git/config are executed when Vibe is started with --worktree, because git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check. The result is execution of attacker commands with user privileges.

CVE-2026-109429 affects Mistral Vibe before 2.25.4 and contains a bypass of its command permission gate. Tree-sitter-bash static parsing misses a command substitution hidden inside a single-quoted variable value, which the attacker re-expands with the ${var@P} prompt-transform operator so bash's promptvars feature runs it at runtime. Only the trailing allowlisted command is classified, so arbitrary commands run silently with the privileges of the agent's terminal session.

Mistral Vibe before 2.25.5 has a permission validation bypass in the _extract_commands() function of bash.py. A parsing mismatch between tree-sitter-bash and bash over backslash-newline line continuations lets an attacker hide a command, such as a curl request, behind an allowlisted prefix like cd, so resolve_permission grants ALWAYS permission and bash runs unauthorized commands.

Mistral Vibe before 2.25.5 contains a remote code execution flaw in its worktree creation process, which runs git hooks before trust validation. An attacker who supplies a repository with a crafted post-checkout hook can execute arbitrary shell commands with the privileges of the user running Vibe.

An arbitrary file access vulnerability in Mistral Vibe lets an attacker bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands allows access to files outside the active workspace without user approval.

CVE-2026-87987 is an arbitrary code execution vulnerability in Mistral Vibe that lets an attacker bypass command permission checks. Environment variable assignments placed before allowlisted commands are excluded from inspection, so attacker-controlled variables can trigger code execution without user approval.

CVE-2026-87986 is an arbitrary code execution vulnerability in Mistral Vibe. Attackers can bypass its command permission checks by using shell constructs the parser cannot interpret. Because the unparsed portions are omitted from inspection, embedded commands run on the user's system without approval.

An arbitrary code execution vulnerability in Mistral Vibe lets an attacker bypass command permission checks by using ANSI-C quoted arguments. These arguments are not properly inspected, so a crafted allowlisted command can run arbitrary code on the user's system without approval.

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, lets an attacker create or overwrite files outside the active workspace without user approval. Shell redirection destinations are left out of permission checks, so otherwise allowlisted commands can write to any path the Vibe process can access.

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, lets an attacker bypass workspace restrictions with quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation allows files outside the active workspace to be read without user approval.