CVE-2026-87987 — mistralai / mistral-vibe

CVE-2026-87987

mistralai / mistral-vibe PUBLISHED

Description (CNA)

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

Affected (CNA)

Vendor / product	Versions
mistralai / mistral-vibe	affected 2.6.0 through *

CWE

CWE-15

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.