Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Mistral Vibe can run code without permission

CVE-2026-87985 · published 29 days ago
Summary

The Mistral Vibe software may let a malicious user run any command on a system, even when those commands are supposed to be blocked. This happens because specially crafted input isn’t checked correctly. Update the software to the latest version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mistralai mistral-vibe <= *
Original advisory text
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling ...
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published11 Sep 2026
Updated7 Oct 2026
First seen11 Sep 2026
Sources
CVE-2026-87985 · NVD
CVE-2026-87985 · MITRE
Track software like this
Free during beta