CVE-2026-109428: Mistral Vibe Auth Bypass Vulnerability

CVE-2026-109428 Overview

CVE-2026-109428 is a permission validation bypass vulnerability in Mistral Vibe versions prior to 2.25.5. The flaw arises from a parsing discrepancy between tree-sitter-bash and bash when handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd, while bash joins the continuation into a different hidden command such as a curl request. The resolve_permission function grants ALWAYS permission based on the extracted prefix, while bash executes unauthorized arbitrary commands. This weakness is categorized under [CWE-436: Interpretation Conflict].

Critical Impact

Attackers can bypass Mistral Vibe's command allowlist and execute arbitrary shell commands with the privileges of the agent process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• Mistral Vibe versions prior to 2.25.5
• Distributions bundling the vulnerable bash.py command parser
• Zed extension mistral-vibe version 2.25.4 and earlier

Discovery Timeline

• 2026-10-13 - CVE-2026-109428 published to the National Vulnerability Database (NVD)
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109428

Vulnerability Analysis

Mistral Vibe uses tree-sitter-bash to statically parse shell commands and determine whether they match an allowlist before execution. The _extract_commands() function in bash.py extracts the leading command token, which resolve_permission then evaluates against the allowlist. When the token matches a safe command such as cd, the agent assigns ALWAYS permission and forwards the raw string to bash for execution.

The two parsers disagree on backslash-newline (\\\n) line continuations. tree-sitter-bash treats the sequence as a terminator and stops reading, while bash folds the continuation back into a single logical line. The attacker-supplied payload therefore passes the allowlist check as cd, but executes as a chained command such as curl under the shell.

Root Cause

The root cause is a parser differential between the security control (tree-sitter-bash) and the executor (bash). The validation layer and the execution layer operate on semantically different views of the same input, violating the principle that security decisions must be made on the same representation that is executed.

Attack Vector

Exploitation requires an attacker to supply a crafted command string to the Mistral Vibe agent, which happens through prompt injection, a malicious tool response, or a user-pasted instruction. User interaction is required to invoke the agent. Once the agent evaluates the string, the allowlist bypass is deterministic and no additional privileges are needed.

The security fix is included in the Mistral Vibe v2.25.5 release. The release metadata was updated in distribution/zed/extension.toml:

 id = "mistral-vibe"
 name = "Mistral Vibe"
 description = "Mistral's open-source coding assistant"
-version = "2.25.4"
+version = "2.25.5"
 schema_version = 1
 authors = ["Mistral AI"]
 repository = "https://github.com/mistralai/mistral-vibe"

Source: GitHub Commit for Mistral Vibe

Detection Methods for CVE-2026-109428

Indicators of Compromise

• Shell command strings containing backslash-newline (\\\n) sequences passed to the Mistral Vibe agent
• Unexpected curl, wget, or outbound network invocations spawned from a Mistral Vibe process after an apparently benign cd command
• Agent audit logs showing resolve_permission granting ALWAYS for commands whose executed form differs from the logged prefix

Detection Strategies

• Compare the command string extracted by _extract_commands() with the full argv passed to bash and alert on divergence
• Instrument bash.py to log any input containing line continuations and flag these for review
• Monitor process ancestry for Mistral Vibe spawning network utilities such as curl, wget, or nc

Monitoring Recommendations

• Enable verbose logging in the Mistral Vibe agent to capture both parsed and executed command forms
• Baseline normal outbound connections from developer workstations running Mistral Vibe and alert on new destinations
• Correlate agent prompt content with subsequent shell execution events in the Singularity Data Lake using OCSF-normalized process telemetry

How to Mitigate CVE-2026-109428

Immediate Actions Required

• Upgrade Mistral Vibe to version 2.25.5 or later across all developer environments and CI runners
• Update the Zed mistral-vibe extension to 2.25.5 to pick up the fixed command parser
• Audit recent agent sessions for commands containing backslash-newline sequences
• Restrict Mistral Vibe execution to least-privilege user accounts without access to production credentials

Patch Information

The fix is delivered in Mistral Vibe Release v2.25.5 and merged via GitHub Pull Request #1111. Additional analysis is available in the VulnCheck Advisory on Permission Bypass.

Workarounds

• Disable automatic approval of bash tool invocations until the upgrade is applied
• Require manual confirmation for every shell command, bypassing the vulnerable allowlist path
• Pre-sanitize agent input to reject commands containing \\\n sequences before they reach _extract_commands()

# Upgrade Mistral Vibe to the patched release
pip install --upgrade 'mistral-vibe>=2.25.5'

# Verify installed version
mistral-vibe --version

# Temporary input filter until the upgrade is deployed
if printf '%s' "$CMD" | grep -q $'\\\n'; then
  echo "Rejected: line continuation detected" >&2
  exit 1
fi