CVE-2026-87985

Arbitrary Code Execution via ANSI-C Quoted Argument Bypass in Mistral Vibe

Published Sep 11, 2026 CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Description

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.

Analysis

Technical impact

An arbitrary code execution flaw exists in Mistral Vibe. The application fails to properly inspect ANSI-C quoted arguments when processing allowlisted commands. An attacker can supply a specially crafted quoted argument that bypasses command permission checks, causing the allowlisted command to execute arbitrary code on the host without user approval. This weakness corresponds to CWE-184.

Affected Systems

The vulnerability impacts the Mistral Vibe is provided, so all installations of Mistral Vibe are potentially vulnerable until a patch is applied.

Risk and Exploitability

The flaw carries a CVSS score of 10, indicating it is a critical vulnerability. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a crafted ANSI-C quoted argument to a caller of an allowlisted command; Based on the description, it is inferred that the attacker must be able to influence the command argument through any user interface that passes arguments to commands. Therefore the likely attack vector is local command execution, but remote exploitation is possible if the application accepts remote input.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mistralai

mistral-vibe

unaffected

Version	Status	Constraints
`2.9.0`	affected	≤ *

No data.

Vendor Product Versions

Mistral

Mistral-vibe

Version	Status	Scheme	Platform
`[2.9.0,*]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Patch Mistral Vibe to the version that includes the fix for the argument validation flaw
Disable or restrict the use of allowlisted commands that accept external arguments, ensuring only trusted commands are executed
Enable the configuration option to disable ANSI-C quoting, if provided, to prevent the bypass
Run the Mistral Vibe service with the least privileges necessary to limit the impact of any successful exploitation

Generated by OpenCVE AI on September 11, 2026 at 16:08 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.564% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3

History

Sep 13, 2026 7:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mistral Mistral mistral-vibe
Vendors & Products		Mistral Mistral mistral-vibe

Sep 11, 2026 4:30 PM Title updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Arbitrary Code Execution via ANSI-C Quoted Argument Bypass in Mistral Vibe
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 2:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
Weaknesses		CWE-184
References		https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`