Six vulnerabilities published on the same day against Mistral’s coding agent, all in the same authorisation layer. The command the agent inspects before deciding is not the command the shell runs.
The facts
On 11 September 2026, HiddenLayer published, acting as a CNA (1), six CVEs (2) affecting Mistral Vibe, Mistral’s command-line coding agent. Four are scored 10.0 under CVSS (3) 4.0, one 9.3 and one 9.2. All six are credited to the same researcher, Esteban Tonglet, and target the same component: the module that decides whether a shell command may run without asking the user.
Mistral Vibe is distributed under the Apache 2.0 licence and installed from PyPI, through the vendor’s install script, uv or pip. It runs on the developer’s workstation with that account’s privileges, and it exposes a shell execution tool whose invocations are partly approved automatically.
None of these six vulnerabilities involves the language model. They are flaws in ordinary code within the authorisation layer wrapped around the model: string parsing, hand-maintained lists, path normalisation.
One flaw, six routes
The shared mechanism fits in one sentence. Vibe rebuilds a representation of the command from the syntax tree produced by tree-sitter-bash, then makes its authorisation decision from that representation. The shell, meanwhile, runs the original string. Every time the representation drops an element the shell keeps, the decision applies to something other than what is about to execute.
Five of the six flaws work that way. The sixth comes from a gap between two internal lists. The CWE (4) categories differ, the effect is the same: a command runs without the user being asked.
| CVE | Effect | Element lost or unchecked | CVSS 4.0 | CWE | Introduced in |
|---|---|---|---|---|---|
| CVE-2026-87983 | Arbitrary read | Quotation marks kept in the path, which stops being seen as absolute | 9.2 | CWE-22 | 2.6.0 |
| CVE-2026-87984 | Arbitrary write | Shell redirection target not extracted | 9.3 | CWE-22 | 1.3.4 |
| CVE-2026-87985 | Code execution | ANSI-C quoted argument not collected, the -exec predicate of find disappears | 10.0 | CWE-184 | 2.9.0 |
| CVE-2026-87986 | Code execution | Syntax the parser cannot read, placed under an error node | 10.0 | CWE-228 | 1.3.4 |
| CVE-2026-87987 | Code execution | Environment variable assignments stripped before the check | 10.0 | CWE-15 | 2.6.0 |
| CVE-2026-87988 | Arbitrary read and write | Thirty-one auto-approved commands absent from the list subject to path validation | 10.0 | CWE-732 | 2.15.0 |
Two illustrations
For CVE-2026-87983, the command cat "/etc/bashrc" is enough. The boundary check receives the token with its quotation marks. Since the first character is not a slash, the path is not treated as absolute, it is resolved relative to the current directory and appears to stay inside the workspace. Bash then strips the quotes and cat reads the real file. The same command without quotes does trigger the approval prompt.
For CVE-2026-87987, the attacker places environment variable assignments in front of an allowlisted command: GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=diff.external GIT_CONFIG_VALUE_0='...' git diff. The assignments are removed from the representation used for the decision, leaving only git diff, which is on the allowlist, the set of commands approved without prompting. Bash then launches Git with the full environment, Git loads the external diff program and runs it.
Classifying a command as read only does not even guarantee that it cannot write. In the list covered by CVE-2026-87988, sort through its output option, uniq through its second positional argument and less through its save option are all able to produce a file. The category describes the intended use, not what the binary can actually do.
That is the point that outlives this one product. An allowlist does not describe what a program can do, it describes what its author believes it does. As soon as two lists coexist, one to authorise and one to check, the gap between them becomes the attack surface.
Eight months of accumulation
The introduction versions stated by the CNA do not point to a one-off regression. Set against the release dates of those versions on PyPI, they span eight months of development.
- Version 1.3.4, released on 8 January 2026: CVE-2026-87984 and CVE-2026-87986
- Version 2.6.0, released on 23 March 2026: CVE-2026-87983 and CVE-2026-87987
- Version 2.9.0, released on 28 April 2026: CVE-2026-87985
- Version 2.15.0, released on 12 June 2026: CVE-2026-87988
Two of these flaws were therefore exploitable for eight months. The latest release on PyPI at the time of writing is 2.25.1, dated 9 September 2026, two days before the advisories. No fixed version has been announced, neither by the vendor nor in the advisories themselves.
The product checks PyPI once a day for a newer version and offers the update at the next launch. That mechanism will speed up deployment of the fix once it ships, but it does not replace an inventory: it does not tell the operator how many workstations carry the tool.
Source qualification
The advisories come from the CNA itself and link to specific lines in the vendor’s public repository. The level of evidence is high, with one reservation about the scoring.
| Item | Status | Comment |
|---|---|---|
| Mechanisms and affected code | corroborated | Six HiddenLayer advisories, with links into the public source code |
| Scores and CWE categories | corroborated | Values agree between the vendor advisories and the CVEFeed records |
| Introduction versions | single source | Stated by the CNA, not cross-checked. Their release dates are verified on PyPI |
| No fixed version available | corroborated | No PyPI release after 9 September 2026, no fix mentioned in the advisories |
| Network vector used in the score | single source | See the reservation below |
| Exploitation observed | discarded | No reports at the time of writing |
| Coverage by secondary aggregators | discarded | CVE identifiers inconsistent with the original advisories |
All six vectors use AV:N, meaning network exploitation, for a tool that runs on the developer’s own workstation. That reading holds if the attacker is understood to be the content ingested by the agent: a cloned repository, a page it browses, a ticket it reads. Two of the six advisories explicitly name indirect prompt injection as the route, which makes the reading coherent. A 10.0 reached that way is still not comparable to a 10.0 on an exposed service.
Assessment
This analysis is built on the six CNA advisories, the matching CVEFeed records, the product documentation and the release history published on PyPI. The source code was not reviewed line by line and no reproduction was attempted. The exposure and likelihood ratings are judgement, not measurement.
What to do
If Mistral Vibe is present on the estate
- Inventory the installations. The agent is installed at the developer’s initiative and does not appear in the usual software inventory. The binary is called
vibeand its configuration lives in~/.vibe. - Rule out the profiles that approve automatically. All six bypasses target the auto-approval decision. The
askprofile, which prompts for every tool execution, removes the point of that logic. The--auto-approveand--yolooptions disable it entirely and should be banned. - Interpose an external check. The product’s hook mechanism allows a
pre_toolhook that receives the tool arguments before the approval prompt and can deny execution. That check sees the complete command, unlike the internal layer. - Isolate through the system. A container, a dedicated user or a virtual machine, with no access to the user’s home directory or SSH (5) keys.
- Remove from the workstation any cleartext secrets the process can reach: credential files, API (6) tokens, unencrypted private keys.
- Track the release of a fixed version and apply it as soon as it ships.
What this case says about coding agents
The arrangement is the same at every vendor. A model proposes commands, an authorisation layer decides which ones run without prompting. That layer is ordinary code, built from string parsers and hand-maintained lists. Six bypasses published on the same day against a single product give the measure of how solid it is.
The practical consequence is simple. The trust boundary of a coding agent is not the list of its allowlisted commands, it is everything its process can reach. Isolation has to come from the system, through a container, a dedicated user or a restricted mount, not from the tool’s own internal logic.
That leaves the question of the route in. In two of the six advisories, the attacker is not the user but the content the agent reads: a cloned repository, a ticket, a web page. The authorisation layer is the only place where that untrusted input is arbitrated before it becomes a command. It is precisely the place where six flaws have just been published.
Glossary
- CNA (1): CVE Numbering Authority, an organisation authorised to assign CVE identifiers within its scope.
- CVE (2): Common Vulnerabilities and Exposures, the unique public identifier of a vulnerability.
- CVSS (3): Common Vulnerability Scoring System, the standard framework for rating the severity of a vulnerability.
- CWE (4): Common Weakness Enumeration, the classification of software weakness types.
- SSH (5): Secure Shell, an encrypted remote access protocol whose private keys live on the workstation.
- API (6): Application Programming Interface, the programmatic access point to a service, whose authentication tokens often live on the workstation.
Sources
- HiddenLayer, SAI security advisory for CVE-2026-87983, 11 September 2026. hiddenlayer.com
- HiddenLayer, SAI security advisory for CVE-2026-87984, 11 September 2026. hiddenlayer.com
- HiddenLayer, SAI security advisory for CVE-2026-87985, 11 September 2026. hiddenlayer.com
- HiddenLayer, SAI security advisory for CVE-2026-87986, 11 September 2026. hiddenlayer.com
- HiddenLayer, SAI security advisory for CVE-2026-87987, 11 September 2026. hiddenlayer.com
- HiddenLayer, SAI security advisory for CVE-2026-87988, 11 September 2026. hiddenlayer.com
- CVEFeed, records for CVE-2026-87983 through CVE-2026-87988, accessed 11 September 2026. cvefeed.io
- PyPI, mistral-vibe project, release history, accessed 11 September 2026. pypi.org
- Mistral AI, Mistral Vibe documentation, agent profiles, hooks and update settings, accessed 11 September 2026. github.com
Marked TLP:CLEAR, PAP:CLEAR. Unlimited disclosure, no restriction on use.
The analysis presented here reflects the author’s own views and rests on the public sources listed above.
