CVE-2026-87983: Mistral Vibe Path Traversal Vulnerability

CVE-2026-87983 Overview

CVE-2026-87983 is an arbitrary file read vulnerability in Mistral Vibe version 2.6.0 and later. Attackers exploit improper handling of quotation marks during path validation to bypass workspace restrictions. Quoted absolute paths supplied to allowlisted shell commands escape the active workspace boundary. The flaw allows files outside the sandboxed workspace to be read without user approval. The vulnerability is classified as a path traversal weakness [CWE-22].

Critical Impact
Attackers can read arbitrary files on the host, including credentials, source code, and configuration data, without user consent or interaction.

Affected Products

Mistral Vibe version 2.6.0 and later

Discovery Timeline

2026-09-11 - CVE CVE-2026-87983 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-87983

Vulnerability Analysis

Mistral Vibe enforces a workspace boundary that restricts file system access to a designated project directory. Allowlisted shell commands rely on a path validator to reject paths that resolve outside this boundary. The validator fails to normalize input containing quotation marks. When an attacker supplies an absolute path wrapped in single or double quotes, the validation logic treats the quoted string as workspace-relative while the underlying shell interprets it as an absolute path. This inconsistency between the parser and the executing shell produces a classic path traversal condition.

The vulnerability requires no authentication and no user interaction. Any input channel that reaches the allowlisted command execution path can trigger the file read. Successful exploitation returns file contents to the attacker through normal tool output.

Root Cause

The root cause is improper input sanitization during path validation. The validator strips or ignores quotation characters before comparing paths to the workspace boundary. The shell subsequently preserves the quoted content and resolves the absolute path directly. This parser differential between validation and execution is the underlying defect.

Attack Vector

The attack vector is network reachable. An attacker submits a crafted prompt or command containing an allowlisted shell command with a quoted absolute path argument. The validator approves the request. The shell reads the target file and returns its contents. Sensitive targets include SSH keys, cloud credential files, environment configuration, and application secrets.

See the HiddenLayer Security Advisory for technical details.

Detection Methods for CVE-2026-87983

Indicators of Compromise

Allowlisted shell command invocations containing single or double quoted absolute path arguments such as "/etc/passwd" or '/root/.ssh/id_rsa'.
Access log entries showing file reads outside the declared Mistral Vibe workspace directory.
Unexpected outbound data flows following Mistral Vibe command execution events.

Detection Strategies

Inspect Mistral Vibe command execution telemetry for path arguments beginning with a quotation mark followed by a filesystem root character.
Correlate workspace path declarations with actual file open events to identify boundary violations.
Alert on reads targeting sensitive filesystem locations such as /etc/, ~/.ssh/, ~/.aws/, and ~/.config/ originating from Mistral Vibe processes.

Monitoring Recommendations

Enable verbose command auditing within Mistral Vibe and forward logs to a centralized analytics platform.
Deploy filesystem access monitoring on hosts running Mistral Vibe to capture reads outside expected project directories.
Track process lineage from Mistral Vibe to shell interpreters and log the fully resolved argument vector.

How to Mitigate CVE-2026-87983

Immediate Actions Required

Upgrade Mistral Vibe to a patched release above version 2.6.0 once vendor fixes are available.
Restrict Mistral Vibe execution to isolated containers or sandboxed user accounts with minimal filesystem access.
Remove sensitive credentials and keys from directories reachable by the Mistral Vibe service account.

Patch Information

Refer to the HiddenLayer Security Advisory for current patch status and vendor guidance. No official vendor patch identifier is listed in the NVD entry at publication time.

Workarounds

Disable or narrow the allowlist of shell commands available to Mistral Vibe until a patched version is deployed.
Run Mistral Vibe inside a container with read-only bind mounts limited to the intended workspace directory.
Apply mandatory access controls such as AppArmor or SELinux profiles that block reads outside the workspace path.

bash

# Example: run Mistral Vibe in a restricted container with workspace-only access
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  -v /srv/vibe/workspace:/workspace:rw \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  mistral-vibe:latest