{"id":"CVE-2026-87985","title":"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments","summary":"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute…","severity":"critical","cvss":10,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":["CWE-184"],"vendor":"mistralai","product":"mistral-vibe","affected":["mistral-vibe >= 2.9.0 <= *"],"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T17:35:21.440","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87985","references":[{"url":"https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3","label":"6f8de1f0-f67e-45a6-b68f-98777fdb759c"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-11T14:54:11.239020Z"},"cvssSource":"cna","ingestedAt":"2026-09-12T16:22:54.938Z","epss":0.00438,"epssPercentile":0.37404,"slug":"CVE-2026-87985","body":"## Overview\n\nAn arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}