CVE-2026-109428: Mistral Vibe: bash parsing bypass allows hidden commands

Mistral Vibe, a coding agent CLI, can be tricked into running unapproved shell commands because its permission check parses commands differently than bash does. A backslash-newline continuation lets an attacker show an allowlisted prefix like 'cd' to the checker while bash executes a hidden command such as a curl download. The flaw is rated high (CVSS 8.8) and needs a user to process attacker-influenced content, for example a malicious repository or prompt. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, so the immediate exploitation likelihood is unquantified, but the package has 464 downstream dependents and 11 other CVEs. Upgrade to Mistral Vibe 2.25.5 or later, and until then require manual approval for all shell commands and avoid running the agent on untrusted repositories.

No confirmed active exploitation of CVE-2026-109428 has been reported, but organizations should still patch proactively.

1) Upgrade mistral-vibe to 2.25.5 or later (fix in PR #1111, commit c069ffa). 2) Until patched, remove 'always allow' entries for shell commands (cd and similar) and require explicit approval for every bash call. 3) Run the agent in an isolated container or VM with least-privilege credentials and restricted egress. 4) Avoid pointing the agent at untrusted repositories or content. 5) Detection: monitor for unexpected curl/wget or child processes spawned by the agent, and for commands containing backslash-newline sequences in agent logs. 6) Inventory pip installations of mistral-vibe across developer endpoints and CI.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CI/CD pipelines.

CVE-2026-109428 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.51%.