VDB
CVE-2026-87987
CVE-2026-87987
PUBLISHED
CVSS 10 CRITICAL
Reported by HiddenLayer · Published September 11, 2026
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
Risk Scores
CVSS 4.0
10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mistralai | mistral-vibe | 2.6.0 |
| mistralai | mistral-vibe | 2.6.0 |
Timeline
- Sep 11, 2026 CVE Published
- Sep 11, 2026 CVE Updated
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score