CVE-2026-109429

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Mistral Vibe

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109429

EUVD

EUVD-2026-99226

Affected Vendors & Products

Vendor	Product	Version / Range
mistralai	mistral-vibe	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

Mistral Vibe before version 2.25.4 has a command permission gate bypass vulnerability. Attackers can execute arbitrary commands by embedding a command substitution inside a single-quoted variable value. This bypasses static parsing detection. The ${var@P} prompt-transform operator re-expands the variable, using bash's promptvars feature to execute hidden commands at runtime with the privileges of the agent's terminal session.

Detection Guidance

To detect this vulnerability, check the version of Mistral Vibe installed on your system. If it is below 2.25.4, the system is vulnerable. Use commands like 'mistral-vibe --version' or inspect package metadata for version information.

Impact Analysis

This vulnerability allows attackers to silently execute arbitrary commands on your system with the same privileges as the Mistral Vibe agent. This could lead to unauthorized access, data theft, system compromise, or further lateral movement within your environment if the agent has elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially violating data protection requirements under GDPR and HIPAA. It may result in unauthorized access to personal or health data, leading to compliance breaches, regulatory fines, and reputational damage due to insufficient security controls for command execution.

Mitigation Strategies

Upgrade Mistral Vibe to version 2.25.4 or later immediately. This version includes fixes for shell permission checks and command bypass vulnerabilities. Follow the official release notes or update instructions from the Mistral Vibe repository.

Hi! I’m here to help you understand CVE-2026-109429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70