Mistral Vibe Fixes Six Shell Permission Bypass Vulnerabilities
Mistral VibeMistral Vibe's v2.25.4 release closed six vulnerabilities in the module that decides whether a shell command can run without user approval, four of them rated a maximum CVSS score of 10.0. Crafted shell syntax, ANSI-C quoted arguments, environment-variable prefixes, redirection targets, and quoted absolute paths could each slip past Mistral Vibe's permission checks and workspace restrictions, enabling arbitrary code execution or reads and writes outside the active workspace. The fix makes shell permission checks require approval for any risky syntax or command option that could bypass workspace and denylist controls, closing every disclosed bypass path.
Key Takeaways
- Six CVEs, four rated CVSS 10.0, were patched in v2.25.4, all targeting the same shell-command authorization module.
- Ordinary code defects, not model flaws: the bypasses lived in string parsing, allowlist matching, and path normalization around the shell tool, not in the underlying LLM's judgment.
- The bypass techniques varied widely, from unparseable shell constructs and ANSI-C quoted arguments to environment-variable prefixes, redirection targets, and quoted absolute paths.
- Two of the CVEs allowed silent file writes or reads outside the active workspace, letting a crafted command touch files the sandbox was meant to protect.
- Two of the flaws are long-lived: the arbitrary file write dates back to version 1.3.4 and the arbitrary file read to version 2.6.0.
- The episode shows a coding agent's safety boundary is only as strong as its shell-permission parser, since one missed edge case can turn an "allowlisted" command into arbitrary code execution.
Sources & Mentions
4 external resources covering this update
Six Vulnerabilities in Vibe's Shell Permission Layer
Mistral Vibe's v2.25.4 release, published 2026-09-12, patched six vulnerabilities that all target the same component: the authorization layer that decides whether a shell command Mistral Vibe wants to run can execute automatically, without asking the developer first. Four of the six carry a CVSS base score of 10.0, one scores 9.3, and one scores 9.2, placing all six at or near the top of the severity scale.
None of the six issues were flaws in the underlying language model's judgment. Each is an ordinary code defect sitting around the model: gaps in string parsing, manually maintained allowlists, and path normalization logic that a shell command has to pass through before Mistral Vibe decides it is safe to auto-run.
What the Six CVEs Cover
Mistral Vibe's release notes group the fix under a single line, but the underlying CVE records break down into distinct bypass techniques:
- CVE-2026-87988 (arbitrary file access, CVSS 10.0): commands classified as unconditionally allowed skipped path validation, bypassing workspace restrictions.
- CVE-2026-87987 (arbitrary code execution, CVSS 10.0): environment-variable assignments placed before an allowlisted command were excluded from inspection, letting attacker-controlled variables drive code execution.
- CVE-2026-87986 (arbitrary code execution, CVSS 10.0): shell constructs the parser could not interpret had their unparsed portions omitted from inspection entirely, hiding embedded commands from review.
- CVE-2026-87985 (arbitrary code execution, CVSS 10.0): ANSI-C quoted arguments were not properly inspected, letting a crafted allowlisted command execute arbitrary code without approval.
- CVE-2026-87984 (arbitrary file write, CVSS 9.3): shell redirection destinations were excluded from permission checks, so an otherwise allowlisted command could create or overwrite files outside the active workspace without user approval. Introduced in version 1.3.4.
- CVE-2026-87983 (arbitrary file read, CVSS 9.2): quoted absolute paths in allowlisted shell commands bypassed workspace restrictions, exposing files outside the sandbox. Introduced in version 2.6.0.
Each technique shares a pattern: a command that Mistral Vibe's allowlist judged safe on its face carried a hidden second half, whether a redirection, a quoting trick, an environment variable, or a path, that the permission checker never actually looked at.
The Fix
The v2.25.4 changelog records the change in one line: shell permission checks now require approval for risky syntax and command options that could bypass workspace and denylist controls. In practice that means inspecting the whole command rather than only its surface-level name. The same release shipped several unrelated reliability fixes, including more resilient connector discovery and corrected @ file-mention resolution across --add-dir workspace roots, but the shell permission rewrite is the change that matters for anyone relying on Mistral Vibe's automatic command approval to keep it from acting outside an authorized workspace.
Because Mistral Vibe runs on a developer's own machine with that developer's account permissions, and its shell tool is specifically designed to auto-approve some commands, a gap anywhere in that authorization layer means a crafted prompt or a compromised dependency could have quietly executed code or touched files the sandbox was supposed to keep off-limits.