---
id: CVE-2026-87985
title: >-
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker
  to bypass command permission checks using ANSI-C quoted arguments
summary: >-
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker
  to bypass command permission checks using ANSI-C quoted arguments. These
  arguments are not properly inspected, enabling a crafted allowlisted command
  to execute…
severity: critical
cvss: 10
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cwe:
  - CWE-184
vendor: mistralai
product: mistral-vibe
affected:
  - mistral-vibe >= 2.9.0 <= *
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:35:21.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87985'
references:
  - url: 'https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3'
    label: 6f8de1f0-f67e-45a6-b68f-98777fdb759c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-11T14:54:11.239020Z'
cvssSource: cna
ingestedAt: '2026-09-12T16:22:54.938Z'
epss: 0.00564
epssPercentile: 0.44457
---

## Overview

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.