Arbitrary Code Execution Vulnerability in Mistral Vibe by HiddenLayer
CVE-2026-87987

10CRITICAL

Key Information:

Vendor

Mistralai

Status
Mistral-vibe
Vendor
CVE Published:
11 September 2026

What is CVE-2026-87987?

A vulnerability in Mistral Vibe allows attackers to execute arbitrary code by exploiting environment variable assignments. This security flaw allows command permission checks to be bypassed through intentionally crafted environment variables. The vulnerable implementation fails to inspect these variables, leading to unauthorized command execution without user consent, thereby posing a significant threat to the integrity of the system.

Affected Version(s)

mistral-vibe 2.6.0

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.