CVE-2026-87986

CVSS 10.0 (critical) · published 2026-09-11

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

Weakness: CWE-228

Source: NVD CVE-2026-87986

References

• https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.