Description
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
Published: 2026-09-11
Score: 10 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Arbitrary Code Execution via Environment Variable Bypass in Mistral Vibe
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
Weaknesses CWE-15
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: HiddenLayer

Published:

Updated: 2026-09-11T14:59:37.174Z

Reserved: 2026-09-09T19:14:18.451Z

Link: CVE-2026-87987

cve-icon Vulnrichment

Updated: 2026-09-11T14:59:30.719Z

cve-icon NVD

Status : Received

Published: 2026-09-11T15:17:07.793

Modified: 2026-09-11T15:17:07.793

Link: CVE-2026-87987

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T16:15:05Z

Weaknesses