Arbitrary File Write in Mistral Vibe

Executive Summary

CVE-2026-87984 is an arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4. It allows attackers to create or overwrite files outside the active workspace without user approval by exploiting shell redirection destinations that bypass permission checks. This enables otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized file writes outside the active workspace in Mistral Vibe versions 1.3.4 and later. Monitor for suspicious shell redirection commands like echo or printf writing to sensitive paths such as /tmp, /etc, or user home directories. Review Vibe process logs for unexpected file creation events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized modifications to source code, configuration files, or user data. It may enable persistence, data corruption, or even code execution by leveraging the inherited permissions of the Vibe process. Attackers could write malicious files to sensitive system locations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately downgrade Mistral Vibe to a version prior to 1.3.4 or apply patches from the vendor. Restrict file write permissions for the Vibe process to only necessary directories. Implement strict input validation for shell commands and disable shell redirection in Vibe configurations.

Useful 0 Not Useful 0