CVE-2026-87984: Mistral AI shell redirection

CISO Take

Mistral Vibe, an AI coding agent, fails to validate where shell redirection operators like `>` or `>>` point when it checks whether a command is allowlisted, letting an attacker who can influence the agent's instructions make it create or overwrite files anywhere the Vibe process can reach — not just inside the active workspace. There's no CVSS vector, EPSS score, or CISA KEV listing published yet, so this isn't confirmed as actively exploited today, but the vendor rates it critical and it sits in a package with 472 downstream dependents and 8 other CVEs already on record, so the blast radius if weaponized is significant. The realistic exploitation path is indirect prompt injection: content the agent reads — a README, a file in a repo it's asked to work on — instructs it to run a command whose output is silently redirected to a sensitive path such as a shell profile, CI config, git hooks, or SSH authorized_keys file, achieving persistence or further code execution outside the sandbox the permission model was meant to enforce. No patched version is listed in the advisory yet, so treat any Vibe deployment at 1.3.4 or later as unpatched: pin below that version if possible, run Vibe under OS-level isolation (non-privileged user, container, AppArmor/SELinux) rather than trusting its internal command checks, and audit for files modified outside expected project directories since upgrading.

Sources: NVD CISA KEV hiddenlayer.com ATLAS

What is the risk?

Rated critical by the vendor despite no published CVSS vector, EPSS score, or KEV listing, and no public exploit code or Nuclei template exists yet — so near-term mass exploitation is unlikely, but the flaw is trivial to trigger once understood (any allowlisted command plus a redirection operator) and requires no elevated privileges, just the ability to get the agent to run an approved-looking command. The real risk driver is that Vibe is an autonomous coding agent that regularly ingests untrusted content (repo files, task descriptions, tool output), making indirect prompt injection a plausible and low-effort delivery mechanism. Combined with a CWE-22 path-traversal class root cause and a package that already has 8 prior CVEs, this points to a broader pattern of insufficient boundary enforcement in Vibe's permission model rather than an isolated bug.

How does the attack unfold?

Indirect injection

Attacker plants malicious instructions in content the Vibe agent will read, such as a repository README or file comment.

AML.T0051.001

Command generation

Vibe's LLM generates a shell command using a normally allowlisted binary but appends a redirection operator pointing outside the workspace.

AML.T0050

Permission bypass and execution

Vibe's permission check validates only the command, not the redirection destination, so the write executes without additional user approval.

AML.T0053

Persistence / impact

The attacker-controlled write lands in a sensitive file (shell profile, git hook, CI config, SSH keys), giving code execution or persistence beyond the intended workspace.

AML.T0081

Indirect injection

Attacker plants malicious instructions in content the Vibe agent will read, such as a repository README or file comment.

AML.T0051.001

Command generation

Vibe's LLM generates a shell command using a normally allowlisted binary but appends a redirection operator pointing outside the workspace.

AML.T0050

Permission bypass and execution

Vibe's permission check validates only the command, not the redirection destination, so the write executes without additional user approval.

AML.T0053

Persistence / impact

The attacker-controlled write lands in a sensitive file (shell profile, git hook, CI config, SSH keys), giving code execution or persistence beyond the intended workspace.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
767 478 dependents Pushed 8d ago 0% patched Full package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Check the vendor advisory (hiddenlayer.com) and Mistral's release notes for a patched version above 1.3.4 and upgrade immediately once available; until then, avoid or downgrade below 1.3.4 if feasible. Run Vibe inside an OS-level sandbox — a container, restricted user account, or AppArmor/SELinux profile — so that even a successful arbitrary-file-write is confined to a disposable environment rather than the host or CI runner. Do not run Vibe with elevated privileges or service accounts that have broad filesystem access. Audit files modified outside the intended project workspace since any host started running 1.3.4+, with particular attention to shell profiles, git hooks, CI/CD configuration, and credential files. Restrict or review the untrusted content Vibe is allowed to ingest (third-party repos, arbitrary READMEs, issue text) given the indirect-prompt-injection delivery path, and monitor for unexpected file-system writes outside the workspace as a detection signal.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Auth Bypass Agent AML.T0050 - Command and Scripting Interpreter AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-87984?

Mistral Vibe, an AI coding agent, fails to validate where shell redirection operators like `>` or `>>` point when it checks whether a command is allowlisted, letting an attacker who can influence the agent's instructions make it create or overwrite files anywhere the Vibe process can reach — not just inside the active workspace. There's no CVSS vector, EPSS score, or CISA KEV listing published yet, so this isn't confirmed as actively exploited today, but the vendor rates it critical and it sits in a package with 472 downstream dependents and 8 other CVEs already on record, so the blast radius if weaponized is significant. The realistic exploitation path is indirect prompt injection: content the agent reads — a README, a file in a repo it's asked to work on — instructs it to run a command whose output is silently redirected to a sensitive path such as a shell profile, CI config, git hooks, or SSH authorized_keys file, achieving persistence or further code execution outside the sandbox the permission model was meant to enforce. No patched version is listed in the advisory yet, so treat any Vibe deployment at 1.3.4 or later as unpatched: pin below that version if possible, run Vibe under OS-level isolation (non-privileged user, container, AppArmor/SELinux) rather than trusting its internal command checks, and audit for files modified outside expected project directories since upgrading.

Is CVE-2026-87984 actively exploited?

No confirmed active exploitation of CVE-2026-87984 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87984?

Check the vendor advisory (hiddenlayer.com) and Mistral's release notes for a patched version above 1.3.4 and upgrade immediately once available; until then, avoid or downgrade below 1.3.4 if feasible. Run Vibe inside an OS-level sandbox — a container, restricted user account, or AppArmor/SELinux profile — so that even a successful arbitrary-file-write is confined to a disposable environment rather than the host or CI runner. Do not run Vibe with elevated privileges or service accounts that have broad filesystem access. Audit files modified outside the intended project workspace since any host started running 1.3.4+, with particular attention to shell profiles, git hooks, CI/CD configuration, and credential files. Restrict or review the untrusted content Vibe is allowed to ingest (third-party repos, arbitrary READMEs, issue text) given the indirect-prompt-injection delivery path, and monitor for unexpected file-system writes outside the workspace as a detection signal.

What systems are affected by CVE-2026-87984?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding agents / IDE assistants, CI/CD-integrated agent tooling.

What is the CVSS score for CVE-2026-87984?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding agents / IDE assistantsCI/CD-integrated agent tooling

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.

Exploitation Scenario

A developer asks Mistral Vibe to review or work on a third-party open-source repository. That repository contains a README or code comment with hidden instructions (indirect prompt injection) telling the agent to run a normal, allowlisted command — for example, an `echo` or build script — but with its output redirected to a path outside the project, such as `~/.bashrc` or `.git/hooks/pre-commit`. Because Vibe's permission check validates the command itself but not the redirection target, the write proceeds without any additional user approval. The attacker's payload is now persisted in a location that executes on the developer's next shell session or git operation, giving the attacker code execution on the host well beyond the original workspace — and potentially a foothold to pivot into CI/CD systems if the same agent runs in a pipeline context.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.