---
id: CVE-2026-87983
title: >-
  An arbitrary file read vulnerability in Mistral Vibe, introduced in version
  2.6.0, allows an attacker to bypass workspace restrictions using quoted
  absolute paths in allowlisted shell commands
summary: >-
  An arbitrary file read vulnerability in Mistral Vibe, introduced in version
  2.6.0, allows an attacker to bypass workspace restrictions using quoted
  absolute paths in allowlisted shell commands. Improper handling of quotation
  marks during…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'
cwe:
  - CWE-22
vendor: mistralai
product: mistral-vibe
affected:
  - mistral-vibe >= 2.6.0 <= *
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:35:21.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87983'
references:
  - url: 'https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe'
    label: 6f8de1f0-f67e-45a6-b68f-98777fdb759c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T14:53:37.235572Z'
cvssSource: cna
ingestedAt: '2026-09-14T12:27:14.810Z'
epss: 0.00417
epssPercentile: 0.35642
---

## Overview

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.