An arbitrary code execution flaw exists in Mistral Vibe. The application fails to properly inspect ANSI-C quoted arguments when processing allowlisted commands. An attacker can supply a specially crafted quoted argument that bypasses command permission checks, causing the allowlisted command to execute arbitrary code on the host without user approval. This weakness corresponds to CWE-184.

The vulnerability impacts the Mistral Vibe is provided, so all installations of Mistral Vibe are potentially vulnerable until a patch is applied.

The flaw carries a CVSS score of 10, indicating it is a critical vulnerability. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a crafted ANSI-C quoted argument to a caller of an allowlisted command; Based on the description, it is inferred that the attacker must be able to influence the command argument through any user interface that passes arguments to commands. Therefore the likely attack vector is local command execution, but remote exploitation is possible if the application accepts remote input.