CVE-2026-87983: critical vulnerability in mistralai mistral-vibe
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.6%
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
mistralai · mistral-vibeRelated CVEs — mistralai mistral-vibe
In the same product, most dangerous first.
CVE-2026-67623HIGHMistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor HookEPSS 1.1%CVE-2026-93993HIGHMistral Vibe before 2.25.5 Remote Code Execution via git post-checkoutEPSS 0.8%CVE-2026-87987CRITICALCVE-2026-87987EPSS 0.6%CVE-2026-87986CRITICALCVE-2026-87986EPSS 0.6%CVE-2026-87985CRITICALCVE-2026-87985EPSS 0.6%CVE-2026-109429HIGHMistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-TransformEPSS 0.6%