CVE-2026-87983
Received Received - Intake

Arbitrary File Read in Mistral Vibe via Quoted Path Bypass

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: HiddenLayer

Description
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-87983
EUVD
EUVD-2026-76118

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mistral vibe 2.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-87983 is a high-severity arbitrary file read vulnerability in Mistral Vibe (version 2.6.0 and later). It allows attackers to bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. The issue occurs because path validation fails to account for shell quote removal, enabling commands like cat or head to read files outside the intended workspace without permission.

Detection Guidance

Check Mistral Vibe version with pip show mistral-vibe. If version 2.6.0 or later is installed, the system may be vulnerable. Inspect logs for allowlisted commands like cat, head, tail, stat, or wc accessing files outside the workspace. Use system monitoring tools to detect unexpected file reads by the Vibe process.

Impact Analysis

This vulnerability could allow attackers to read sensitive files such as credentials, API tokens, SSH keys, configuration files, and source code accessible to the Vibe process. Since it bypasses workspace restrictions, it may expose confidential data without triggering user approval.

Mitigation Strategies

Update Mistral Vibe to the latest patched version immediately. Disable or restrict allowlisted shell commands in Mistral Vibe configuration. Implement strict workspace access controls and file permission reviews. Monitor for unusual file access patterns by the Vibe process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart