Mistral Vibe Shell Permission Bypass: Env-Var Prefix RCE and Unchecked Redirect File Write (CVE-2026-87987 CVSS 10.0, CVE-2026-87984 CVSS 9.3)

HiddenLayer published two advisories on 11 September 2026, credited to Esteban Tonglet, for permission-check bypasses in the Bash tool of Mistral Vibe. CVE-2026-87987 (CVSS 4.0 10.0): the permission check stripped leading environment-variable assignments before matching a command against its allowlist, but the shell still applied them, so an allowlisted command such as `git diff --ext-diff` with GIT_EXTERNAL_DIFF set, or `cat` with a modified PATH, ran attacker-chosen code with no approval prompt. CVE-2026-87984 (CVSS 4.0 9.3): redirect targets were left out of the workspace path check, so `echo x > /tmp/pwned` wrote outside the workspace without a prompt. SecMate independently reported the same class on 5 September and published on 23 September, demonstrating delivery through a hostile repository that ended with the victim's Mistral token exfiltrated. Per Mistral's advisory MAI-2026-003 as reproduced by SecMate, CVE-2026-87984 affects 1.3.4 to 2.25.3 and CVE-2026-87987 affects 2.6.0 to 2.25.3, both fixed in 2.25.4 (12 September), which makes the shell analysis fail closed; Mistral added further hardening through 2.25.8 and recommends that version. NVD records list no upper bound.

You are affected if you run mistral-vibe >=1.3.4 <2.25.4. Versions 2.25.8 and later include the fix.

Upgrade Mistral Vibe to 2.25.8 or later, restart active sessions and confirm with `vibe --version`. Until every install is upgraded, do not let Vibe work on untrusted repositories, submodules or issue content, since the attack starts from repository text the model reads. Keep MISTRAL_API_KEY and other high-value credentials out of the agent's environment unless the task needs them, and rotate the Mistral token on machines that ran vulnerable versions against untrusted code. Run the agent inside an OS or container sandbox rather than relying on its command-approval logic as the boundary.