---
id: CVE-2026-87986
title: >-
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker
  to bypass command permission checks using shell constructs it's parser cannot
  interpret
summary: >-
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker
  to bypass command permission checks using shell constructs it's parser cannot
  interpret. Unparsed portions are omitted from inspection, enabling embedded
  comman…
severity: critical
cvss: 10
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cwe:
  - CWE-228
vendor: mistralai
product: mistral-vibe
affected:
  - mistral-vibe >= 1.3.4 <= *
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:35:21.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87986'
references:
  - url: 'https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4'
    label: 6f8de1f0-f67e-45a6-b68f-98777fdb759c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-11T14:53:56.024113Z'
cvssSource: cna
ingestedAt: '2026-09-11T16:45:47.862Z'
epss: 0.00564
epssPercentile: 0.44533
---

## Overview

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.