by Kastro
Paper/Archive/CVE-2026-87984

CVE-2026-87984

mistralai mistral-vibe — An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outsi…

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 42.6.426 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.

Affected

ProductAffectedFixed inSource
mistral-vibe1.3.4 – *–CNA

Scores by source

HiddenLayer (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe2