Arbitrary File Read Vulnerability in Mistral Vibe
CVE-2026-87983

9.2CRITICAL

Key Information:

Vendor

Mistralai

Status
Mistral-vibe
Vendor
CVE Published:
11 September 2026

What is CVE-2026-87983?

Mistral Vibe suffers from an arbitrary file read vulnerability due to improper handling of quotation marks in path validation. This flaw allows attackers to bypass workspace restrictions using quoted absolute paths within allowlisted shell commands, potentially enabling unauthorized access to files residing outside the active workspace without requiring user consent.

Affected Version(s)

mistral-vibe 2.6.0

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.