Permission Validation Bypass in Mistral Vibe by Mistral AI

CVE-2026-109428

What is CVE-2026-109428?

Mistral Vibe prior to version 2.25.5 features a vulnerability that permits attackers to bypass permission validations. This occurs due to a discrepancy in how command line continuations are processed by the tree-sitter-bash parser and bash itself. Attackers can craft command strings where only an allowlisted prefix is recognized by tree-sitter-bash, while the actual execution occurs with a modified command that can include harmful actions. This flaw may lead to unauthorized execution of commands within the environment, allowing potential exploitation of the system.

References