CVE-2026-87988
Received Received - Intake

Arbitrary File Access in Mistral Vibe via Unvalidated Commands

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: HiddenLayer

Description
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-87988
EUVD
EUVD-2026-76123

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mistral vibe *
mistral vibe 2.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-87988 is an arbitrary file access vulnerability in Mistral Vibe where attackers can bypass workspace restrictions using unconditionally allowed commands. Missing path validation for these commands lets them access files outside the active workspace without user approval.

Detection Guidance

To detect this vulnerability, check if Mistral Vibe v2.15.0 is installed and review the _READ_ONLY_COMMANDS_POSIX list for unvalidated commands. Look for unusual file access patterns or commands using absolute paths outside the workspace.

Impact Analysis

This vulnerability allows attackers to read or modify sensitive files anywhere on the host system, including credentials, configuration files, or source code. Some commands can even write to arbitrary locations, leading to potential data breaches or system compromise.

Mitigation Strategies

Immediately upgrade Mistral Vibe to a patched version. Remove or restrict the 31 unconditionally allowed commands in _READ_ONLY_COMMANDS_POSIX. Implement strict path validation for all commands to enforce workspace boundaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart