CVE-2026-87984: Mistral Vibe Path Traversal Vulnerability

CVE-2026-87984 Overview

CVE-2026-87984 is an arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4. The flaw allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from Vibe's permission checks. As a result, allowlisted commands can redirect output to arbitrary paths accessible to the Vibe process. The issue is classified under CWE-22 (Path Traversal) and carries a CVSS 4.0 score of 9.3.

Critical Impact
An attacker can write to any filesystem path the Vibe process can reach, enabling code execution, configuration tampering, and persistence outside the sandboxed workspace.

Affected Products

Mistral Vibe version 1.3.4 and later releases prior to the vendor fix
Environments running Vibe with shell command execution enabled
Deployments relying on the workspace scope as a security boundary

Discovery Timeline

2026-09-11 - CVE-2026-87984 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-87984

Vulnerability Analysis

Mistral Vibe enforces a workspace-scoped permission model that gates file operations initiated by shell commands. The permission logic inspects the command and its arguments against an allowlist and validates target paths against the active workspace boundary.

The validation logic does not evaluate shell redirection operators such as >, >>, or tee destinations. An allowlisted command like echo or cat passes the allowlist check, and its redirection target escapes path validation entirely. This gives the caller a primitive to write files anywhere the Vibe process user can reach.

Because the write occurs through a legitimate, approved command channel, no user approval prompt is triggered. Refer to the HiddenLayer Security Advisory for the full technical writeup.

Root Cause

The root cause is incomplete parsing of shell command syntax during authorization. Vibe checks the executable and positional arguments but treats redirection metadata as opaque shell plumbing. Redirection targets never reach the workspace boundary check, breaking the trust model that governs file writes.

Attack Vector

An attacker who can influence commands executed by Vibe, through prompt injection, a malicious repository, or a compromised upstream context, can append a redirection clause to any allowlisted command. Writing to paths such as ~/.ssh/authorized_keys, shell startup files, or CI/CD configuration files converts the file write into code execution or credential compromise.

Exploitation code is not required. The vulnerability is triggered by ordinary shell syntax appended to commands the tool already permits. See the HiddenLayer Security Advisory for exploitation details.

Detection Methods for CVE-2026-87984

Indicators of Compromise

Unexpected files created or modified outside the declared Vibe workspace directory
Shell history or process telemetry showing allowlisted commands with >, >>, or | tee targeting paths such as ~/.ssh/, ~/.bashrc, or system configuration directories
New or modified files owned by the Vibe process user in locations the workspace should not touch

Detection Strategies

Audit process execution telemetry for Vibe child processes invoking shells with redirection operators pointing outside the workspace root
Correlate Vibe session logs with filesystem write events to identify writes that bypass approval prompts
Deploy filesystem integrity monitoring on sensitive paths accessible to accounts that run Vibe

Monitoring Recommendations

Enable command-line argument capture on endpoints that host Vibe to preserve redirection syntax in telemetry
Alert on writes to authentication, shell profile, and scheduled task paths by any Vibe-spawned process
Track version strings of Mistral Vibe across the fleet to identify hosts running 1.3.4 or later unpatched builds

How to Mitigate CVE-2026-87984

Immediate Actions Required

Upgrade Mistral Vibe to the vendor-supplied fixed release once available and inventory all hosts running version 1.3.4 or later
Run Vibe under a dedicated low-privilege account with no access to credentials, SSH keys, or system configuration directories
Disable or restrict shell command execution in Vibe for untrusted workspaces and prompt sources

Patch Information

Consult the HiddenLayer Security Advisory for the vendor-coordinated fix and updated version guidance. Apply the fixed release across all Vibe installations and validate that redirection destinations are subject to workspace boundary checks after patching.

Workarounds

Wrap Vibe execution in a filesystem sandbox such as bubblewrap, firejail, or a container that mounts only the intended workspace as writable
Remove shell metacharacter support from allowlisted commands where feasible, or route commands through a wrapper that rejects redirection operators
Apply mandatory access control policies (AppArmor, SELinux) that confine the Vibe process to the workspace directory tree

bash

# Configuration example: confine Vibe to its workspace with bubblewrap
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  --bind /home/vibe/workspace /home/vibe/workspace \
  --unshare-all \
  --die-with-parent \
  vibe --workspace /home/vibe/workspace