CVE-2026-87987
Received Received - Intake

Arbitrary Code Execution in Mistral Vibe via Environment Variable Bypass

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: HiddenLayer

Description
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-87987
EUVD
EUVD-2026-76122

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mistral vibe *
mistral vibe From 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Mistral Vibe allows attackers to execute arbitrary code by bypassing command permission checks. Attackers can manipulate environment variables that are excluded from inspection but still passed to executed programs. For example, they can set Git's diff.external to run malicious commands, which are executed without user approval due to the oversight.

Detection Guidance

To detect this vulnerability, inspect Mistral Vibe installations for suspicious environment variable usage in commands. Check for commands like 'git diff' where external configuration (e.g., diff.external) might be set via environment variables. Review logs for unexpected command executions or environment variable assignments preceding allowlisted commands.

Impact Analysis

If exploited, this vulnerability could allow attackers to run unauthorized commands on your system, potentially leading to data theft, system compromise, or further network infiltration. It could be triggered through indirect prompt injection, making routine commands like git diff dangerous.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements under GDPR (data protection) and HIPAA (health information security). Organizations using Mistral Vibe may face legal penalties, reputational damage, and increased scrutiny for failing to protect sensitive data.

Mitigation Strategies

Immediately update Mistral Vibe to a patched version if available. As a temporary fix, include environment variable assignments in authorization checks to prevent bypassing command permissions. Disable or restrict indirect prompt injection vectors that could trigger vulnerable commands like 'git diff'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart