CVE-2026-87986 — mistralai / mistral-vibe

CVE-2026-87986

mistralai / mistral-vibe PUBLISHED

Description (CNA)

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

Affected (CNA)

Vendor / product	Versions
mistralai / mistral-vibe	affected 1.3.4 through *

CWE

CWE-228

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.