Mistral Vibe before version 2.25.4 contains a privilege‑gate bypass that allows an attacker to execute arbitrary commands. The flaw permits embedding a command substitution inside a single‑quoted variable value that the tree‑sitter‑bash parser cannot detect. By re‑expanding that value with the ${var@P} prompt‑transform operator, bash’s promptvars feature executes the concealed command at runtime, while only the explicitly allowed trailing command is classified. This results in silent command execution with the privileges of the agent’s terminal session.

The vulnerability affects the Mistral Vibe product from Mistral AI. All releases prior to 2.25.4 are impacted. No further version details are listed beyond the <2.25.4 boundary.

The CVSS score of 8.7 indicates high severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to involve an attacker supplying malicious input that triggers the prompt‑transform process; this likely requires local access or compromise of the source feeding data to the agent. Once the input is executed, the attacker gains the privileges of the running terminal session, enabling arbitrary command execution.