VulnerabilityDeferred

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands.

CRITICAL 10.0EPSS 0.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

CVSS 4.0: 10.0 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-15
Source: 6f8de1f0-f67e-45a6-b68f-98777fdb759c

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.