Mistral Vibe Narrows Shell Command Approval Scope Again
Mistral VibeMistral Vibe's v2.25.5 release closed a batch of ways a single shell command approval could silently widen to cover more than a developer intended, including a different program, subcommand, custom shell, environment, or a side-effecting option a command's own guardrails were supposed to gate. Line continuations and sort --files0-from now require approval outright, and commands the shell could not fully read no longer inherit a broader existing approval. This follows the six CVE-numbered shell permission bypasses Mistral Vibe fixed just six days earlier in v2.25.4, in the same part of the codebase.
Key Takeaways
- Mistral Vibe closed several ways a single shell approval could silently widen to cover a different program, subcommand, shell, or environment.
- A guardrailed side-effecting option can no longer ride along under an approval meant for a different, safer invocation.
- Line continuations and
sort --files0-from, which can read an arbitrary file list, now require explicit approval. - This follows just six days after v2.25.4 fixed six CVE-numbered shell permission bypasses in the same subsystem.
- A companion change also reduces unnecessary re-prompts for shell commands that differ only in a variable expansion, balancing the tightening with less friction on legitimate repeats.
- No independent third-party coverage exists yet for this specific batch of fixes.
Another Pass at Shell Approval Scope
Just six days after patching six CVE-numbered shell permission bypasses in v2.25.4, Mistral Vibe's v2.25.5 release shipped a further batch of fixes narrowing how broadly a single shell command approval is allowed to apply. None of this release's fixes carry CVE numbers, but they sit in the same subsystem: the logic that decides whether approving one shell command also silently covers a related one.
What No Longer Widens Automatically
The changelog lists several specific cases where an approval previously extended further than it should have:
- An approval no longer widens "to cover a different program, subcommand, custom shell, or environment."
- An approval no longer covers "side-effecting options that the command's guardrails gate," meaning a flag a guardrail was specifically designed to catch could not be smuggled in under an unrelated approval.
- Approving a guardrailed command whose argument the shell could not fully read no longer approves the same command with a different, unreviewed argument.
- A shell call that can only be safely approved exactly as written, such as one using a redirect, a heredoc, or syntax the shell could not parse, is no longer covered by a broader approval for the same program.
Two more fixes close specific gaps outright: shell commands using line continuations now require approval, and sort --files0-from, which can be used to read an arbitrary list of files, now requires approval before reading the files it lists.
A Small Convenience Alongside the Narrowing
Mistral Vibe also loosened approval scope in one legitimate way in the same release: approving a shell command that includes a variable expansion now covers a later call that differs only in that expansion, reducing repeated prompts for genuinely equivalent commands, without reopening any of the gaps described above.
Why It Matters
Mistral Vibe's shell tool is designed to auto-run some commands without asking, which only works safely if an approval covers exactly what a developer reviewed and nothing more. Each of these fixes closes a specific way a command could ride along on an approval it was never actually granted, extending the hardening work from v2.25.4's CVE fixes into cases that were not part of the original CVE disclosures.