CVE-2026-109429: Mistral Vibe: bash gate bypass allows silent RCE

HIGH

Published October 13, 2026

CISO Take

Mistral Vibe, a terminal coding agent, can be tricked into running arbitrary commands because its allowlist check parses bash statically and misses a command substitution hidden in a single-quoted variable that is later re-expanded with the ${var@P} operator. The agent classifies only the trailing allowlisted command as safe, so the hidden payload runs silently with the privileges of the user's terminal session, which typically includes source code, SSH keys, cloud credentials and API tokens. Exploitation requires user interaction (for example, opening a poisoned repository or prompt), and there is currently no public exploit, no Nuclei template, no KEV listing and no EPSS score, so near-term mass exploitation is unlikely. Even so, the CVSS is 8.8, the attack is low complexity, and the package has 464 downstream dependents and 11 other CVEs, which points to a recurring weakness in its permission model. Upgrade to Mistral Vibe 2.25.4 or later, and until then require manual approval for all shell commands and avoid running the agent on untrusted content.

Sources:NVDATLASvulncheck.comgithub.com/mistralai/mistral-vibe

What is the risk?

High. The CVSS 8.8 rating reflects low complexity, no privileges required and full confidentiality, integrity and availability impact. Exploitation depends on the user engaging with attacker-controlled content, such as a malicious repository, a file or a prompt injection that steers the agent. There is no known public exploit or in-the-wild exploitation and no EPSS data, so likelihood is moderate. Impact is high on developer workstations and CI runners where the agent holds credentials. The 11 other CVEs in the same package suggest the permission-gating design has been repeatedly weak.

How does the attack unfold?

Initial Access

The attacker plants crafted content, such as a repository file or issue, that gets the Vibe agent to run a booby-trapped bash command.

AML.T0051.001

Gate Bypass

The tree-sitter-bash static parser sees only the trailing allowlisted command and auto-approves it, missing the hidden substitution in the single-quoted variable.

AML.T0068

Execution

Bash re-expands the variable with ${var@P} and promptvars evaluates the hidden command substitution at runtime.

AML.T0050

Impact

Arbitrary code runs with the terminal session's privileges, enabling credential theft, data exfiltration and lateral movement.

AML.T0112.000

Initial Access

The attacker plants crafted content, such as a repository file or issue, that gets the Vibe agent to run a booby-trapped bash command.

AML.T0051.001

Gate Bypass

The tree-sitter-bash static parser sees only the trailing allowlisted command and auto-approves it, missing the hidden substitution in the single-quoted variable.

AML.T0068

Execution

Bash re-expands the variable with ${var@P} and promptvars evaluates the hidden command substitution at runtime.

AML.T0050

Impact

Arbitrary code runs with the terminal session's privileges, enabling credential theft, data exfiltration and lateral movement.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
774467 dependentsPushed 8d ago0% patchedFull package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mistral-vibe to 2.25.4 or later (see release notes, PR #1084 and commit 19b5b74). 2) Until patched, disable auto-approval and allowlisted commands so every shell command needs explicit human confirmation. 3) Run the agent in a sandbox, container or low-privilege account without production credentials, and use short-lived scoped tokens. 4) Do not point the agent at untrusted repositories, issues, web pages or documents. 5) Detect: monitor for shell commands containing '${' with '@P' or nested $( ) inside single-quoted assignments, unexpected child processes spawned by the agent, and outbound connections from developer terminals. 6) Inventory installs of mistral-vibe via software composition analysis and endpoint tooling.

How is it classified?

Code ExecutionAuth BypassPrompt InjectionAgentFrameworkAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0068- LLM Prompt Obfuscation AML.T0107- Exploitation for Defense Evasion AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109429?

Is CVE-2026-109429 actively exploited?

No confirmed active exploitation of CVE-2026-109429 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109429?

1) Upgrade mistral-vibe to 2.25.4 or later (see release notes, PR #1084 and commit 19b5b74). 2) Until patched, disable auto-approval and allowlisted commands so every shell command needs explicit human confirmation. 3) Run the agent in a sandbox, container or low-privilege account without production credentials, and use short-lived scoped tokens. 4) Do not point the agent at untrusted repositories, issues, web pages or documents. 5) Detect: monitor for shell commands containing '${' with '@P' or nested $( ) inside single-quoted assignments, unexpected child processes spawned by the agent, and outbound connections from developer terminals. 6) Inventory installs of mistral-vibe via software composition analysis and endpoint tooling.

What systems are affected by CVE-2026-109429?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, developer workstations, CI/CD pipelines with autonomous agents.

What is the CVSS score for CVE-2026-109429?

CVE-2026-109429 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsdeveloper workstationsCI/CD pipelines with autonomous agents

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0068LLM Prompt Obfuscation

AML.T0107Exploitation for Defense Evasion

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.

Exploitation Scenario

An attacker publishes or contributes to a repository containing a README or issue text that prompts the Vibe agent to run a seemingly harmless allowlisted command. The command is written as a variable assignment holding a single-quoted command substitution (for example, one that downloads and runs a script), followed by an allowlisted command that expands the variable with ${var@P}. The static parser sees only the allowlisted command and approves it without asking the user. Bash then evaluates the prompt-transform with promptvars enabled, executing the hidden payload that steals SSH keys and cloud tokens from the developer's environment and sends them to the attacker.

Weaknesses (CWE)

CWE-436Interpretation Conflict

CWE-436 — Interpretation Conflict: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE corpus.