Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Mistral Vibe before version 2.25.5 has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in its worktree creation process. The vulnerability occurs because git hooks (scripts that run automatically during git operations) are executed before the system checks whether the repository is trusted, allowing attackers to run malicious commands with the same user privileges as Vibe.
Fix: Upgrade Mistral Vibe to version 2.25.5 or later.
NVD/CVE DatabaseMistral Vibe has a vulnerability where attackers can access files they shouldn't be able to reach by exploiting commands that skip safety checks (workspace restrictions, which limit what folders a user can access). The software doesn't properly validate file paths, meaning someone could read files outside their allowed workspace without permission.
A security vulnerability in Mistral Vibe allows attackers to run unauthorized code by sneaking environment variable assignments (settings that control how programs behave) before allowlisted commands, which bypasses the permission checks that normally prevent this. The vulnerability works because these environment variable assignments are not inspected for safety before the command runs.
Mistral Vibe contains a vulnerability where an attacker can run unauthorized commands on a user's system by using shell constructs (special characters or syntax that the command parser doesn't understand) that the parser cannot interpret. Because unparsed portions are skipped during permission checks, embedded commands can execute without approval.
Mistral Vibe contains a vulnerability where attackers can bypass security checks that normally prevent unauthorized commands from running by using ANSI-C quoted arguments (a special text formatting method). This allows someone to modify an approved command so it secretly runs malicious code on a user's computer without permission.
Mistral Vibe version 1.3.4 has a vulnerability that lets attackers write or overwrite files anywhere on the system without permission. The problem happens because shell redirection (using symbols like > to send output to files) isn't checked for permissions the same way regular commands are, so attackers can bypass security controls.
A vulnerability in Mistral Vibe version 2.6.0 allows attackers to read files they shouldn't have access to by using quoted absolute paths (file locations that start from the root directory) in shell commands, because the system doesn't properly validate quotation marks when checking file access restrictions.
mistral.rs has a vulnerability where the chat completions endpoint downloads media files (images, audio, videos) from URLs without limiting how much data it stores in memory, and extracts every frame from videos when no frame limit is set. An attacker can crash the server by sending it links to infinitely-streaming files or very long high-framerate videos, exhausting the server's memory, disk space, and CPU without needing any authentication.
Mistral Vibe versions before 2.23.3 have an RCE (remote code execution, where attackers can run commands on a victim's computer) vulnerability that lets attackers execute arbitrary commands by hiding malicious code in a repository's .git/config file. When a user runs vibe commands in a crafted repository, the malicious code is triggered through git hooks (automated scripts that git runs at certain points), giving attackers full control over what runs on the victim's system.
Kimi Code versions before 0.27.0 have a security weakness in how it blocks unsafe network requests. The protection uses a static list (denylist) of forbidden hostnames and IP addresses, but it doesn't check if domain names resolve to internal addresses or follow redirects (automatic forwards to different URLs), so an attacker could use prompt injection (tricking the AI by hiding instructions in its input) or craft clever URLs to access internal services that should be blocked. Since FetchURL (a tool for fetching web content) is enabled by default without requiring user approval, this vulnerability is particularly dangerous.
Three Mistral AI npm packages (@mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp) were compromised in a supply chain attack (where malicious code is inserted into legitimate software dependencies) between May 11-12. However, the malicious code, called a dropper (a program designed to download and execute harmful payloads), was broken and failed to run because it referenced the wrong filename. The affected versions have been removed from npm.
Version 2.4.6 of the mistralai package on PyPI contained malicious code that runs when the package is imported on Linux systems. The malicious code downloads and executes a file from a remote server, and versions 2.4.5 and earlier are not affected.
Fix: Update Mistral Vibe to version 2.23.3 or later.
NVD/CVE DatabaseFix: Update to version 0.27.0 or later.
NVD/CVE DatabaseFix: 1. Stop using the affected package versions immediately (2.2.2, 2.2.3, 2.2.4 for @mistralai/mistralai; 1.7.1, 1.7.2, 1.7.3 for @mistralai/mistralai-azure and @mistralai/mistralai-gcp). 2. Clean systems where these packages were installed. Check your installed versions using 'npm ls' or by searching your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) for the affected version numbers. Also check build artifacts, container images, and package caches for the malicious files: router_init.js, tanstack_runner.js, or @tanstack/setup package.json.
GitHub Advisory DatabaseFix: Pin mistralai to version 2.4.5 or earlier. The source text states: 'Pin mistralai to 2.4.5 or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. git+https://github.com/mistralai/client-python.git@v2.4.5.' Additionally, on affected Linux hosts, rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward.
GitHub Advisory Database