Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-87986: Mistral Vibe may run unwanted code on your system
CVE-2026-87986 · published 29 days ago
Summary
The Mistral Vibe application can be tricked into running commands that should be blocked. An attacker could hide instructions that execute on the host computer without approval, risking data loss or system misuse. Apply the latest security update from Mistral AI and restrict who can provide input to the program.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mistralai | mistral-vibe | <= * |
Original advisory text
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted f...
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
10.0
Critical
Type
CWE-228Improper Handling of Syntactically Invalid Structure
Timeline
Published11 Sep 2026
Updated7 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta