AI Threat Alert
CVE-2026-87985: Mistral Vibe: ANSI-C quote bypass enables RCE
CRITICAL CISA: TRACK*Mistral Vibe, Mistral's AI coding agent, fails to properly inspect ANSI-C quoted arguments ($'...') before running a command through its allowlist-based permission check, letting an attacker disguise a malicious command as an approved one and get it executed without the user ever seeing an approval prompt. This is rated critical and affects a tool with 472 downstream dependents, meaning any team that lets Mistral Vibe run commands autonomously in a repo, CI job, or dev shell is exposed to silent arbitrary code execution — no phishing, no separate exploit chain, just a crafted command the agent was trusted to gate. There's no CISA KEV listing, no public exploit, and no EPSS data yet, so this looks pre-exploitation rather than actively weaponized, but the bug class (a security-critical allowlist that mis-parses shell quoting) is trivial to weaponize once understood and the vendor advisory is already public. No patched version is listed in the data provided, so until Mistral ships a fix, treat Vibe's command-approval gate as unreliable: disable auto-approval / allowlist-based execution, require manual confirmation for every shell command it proposes, and avoid running it against untrusted repos or in unattended CI pipelines. Monitor process execution logs on developer machines and build agents for shell invocations originating from the Vibe process that weren't interactively approved.
What is the risk?
Critical. The flaw defeats the core safety control of an AI coding agent — the human-in-the-loop command approval gate — via a parsing gap (CWE-184, incomplete denylist/allowlist input inspection) rather than a complex chained exploit. Exploitability is low-effort for anyone who understands POSIX/bash ANSI-C quoting syntax; no AI/ML expertise is required, only knowledge of the agent's command-matching logic. Impact is full arbitrary code execution in the context of whatever user or CI identity is running Vibe, which typically has access to source code, credentials, and local network resources. The absence of KEV listing, public exploit code, or EPSS scoring lowers confidence in imminent mass exploitation, but the vulnerability class — permission-check bypass in an autonomous coding agent — is high-value to attackers because a single successful bypass yields code execution with developer-level trust, not just data leakage.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Mistral AI | pip | — | No patch |
Do you use Mistral AI? You're affected.
How severe is it?
What should I do?
1 step-
1) Check for a Mistral Vibe patch/advisory update beyond the referenced HiddenLayer disclosure and upgrade as soon as one ships — no patched version is currently specified. 2) Until patched, disable allowlist-based auto-approval entirely and require interactive confirmation for every command Vibe proposes, especially when operating on repos or content from untrusted sources. 3) Run Vibe inside a sandboxed/ephemeral environment (container, disposable VM, restricted CI runner) with no access to long-lived credentials or sensitive network segments, so a bypass caps out at container-level compromise. 4) Add detection: log and alert on shell commands spawned by the Vibe process that contain ANSI-C quoting syntax ($'...') or that were executed without a corresponding interactive-approval log entry. 5) Audit any CI/automation that invokes Vibe non-interactively (headless mode) — that's the highest-risk configuration since there's no human to catch the bypass in real time.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-87985?
Mistral Vibe, Mistral's AI coding agent, fails to properly inspect ANSI-C quoted arguments ($'...') before running a command through its allowlist-based permission check, letting an attacker disguise a malicious command as an approved one and get it executed without the user ever seeing an approval prompt. This is rated critical and affects a tool with 472 downstream dependents, meaning any team that lets Mistral Vibe run commands autonomously in a repo, CI job, or dev shell is exposed to silent arbitrary code execution — no phishing, no separate exploit chain, just a crafted command the agent was trusted to gate. There's no CISA KEV listing, no public exploit, and no EPSS data yet, so this looks pre-exploitation rather than actively weaponized, but the bug class (a security-critical allowlist that mis-parses shell quoting) is trivial to weaponize once understood and the vendor advisory is already public. No patched version is listed in the data provided, so until Mistral ships a fix, treat Vibe's command-approval gate as unreliable: disable auto-approval / allowlist-based execution, require manual confirmation for every shell command it proposes, and avoid running it against untrusted repos or in unattended CI pipelines. Monitor process execution logs on developer machines and build agents for shell invocations originating from the Vibe process that weren't interactively approved.
Is CVE-2026-87985 actively exploited?
No confirmed active exploitation of CVE-2026-87985 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-87985?
1) Check for a Mistral Vibe patch/advisory update beyond the referenced HiddenLayer disclosure and upgrade as soon as one ships — no patched version is currently specified. 2) Until patched, disable allowlist-based auto-approval entirely and require interactive confirmation for every command Vibe proposes, especially when operating on repos or content from untrusted sources. 3) Run Vibe inside a sandboxed/ephemeral environment (container, disposable VM, restricted CI runner) with no access to long-lived credentials or sensitive network segments, so a bypass caps out at container-level compromise. 4) Add detection: log and alert on shell commands spawned by the Vibe process that contain ANSI-C quoting syntax ($'...') or that were executed without a corresponding interactive-approval log entry. 5) Audit any CI/automation that invokes Vibe non-interactively (headless mode) — that's the highest-risk configuration since there's no human to catch the bypass in real time.
What systems are affected by CVE-2026-87985?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CLI-based coding agents, tool invocation / function-calling pipelines.
What is the CVSS score for CVE-2026-87985?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0050 Command and Scripting Interpreter AML.T0053 AI Agent Tool Invocation AML.T0102 Generate Malicious Commands AML.T0107 Exploitation for Defense Evasion Compliance Controls Affected
What are the technical details?
Original Advisory
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.
Exploitation Scenario
A developer opens a public or third-party repository in an IDE with Mistral Vibe enabled and asks it to help fix an issue. The repository (or an issue/PR description, or a file Vibe reads as part of its context) contains a crafted string using ANSI-C quoting — e.g. a command argument wrapped as $'...' — designed to visually and structurally resemble an already-allowlisted command. When Vibe's permission layer checks the proposed command against its allowlist, it fails to properly decode/normalize the ANSI-C quoted argument and matches it as safe, so it either skips the approval prompt or presents a misleading one. The command executes with the developer's local privileges, giving the attacker code execution on the workstation — from which they can exfiltrate source code and credentials, pivot into CI/CD systems, or plant a backdoor, all without the victim ever knowingly approving a suspicious action.
Weaknesses (CWE)
CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
- [Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.
Source: MITRE CWE corpus.
Timeline
Related Vulnerabilities
GHSA-wx9m-wx4f-4cmg 9.6 mistralai 2.4.6: supply chain dropper executes on import
Same package: mistralai CVE-2026-67623 8.8 Mistral Vibe: RCE via malicious git fsmonitor hook
Same package: mistralai CVE-2026-93993 8.8 Analysis pending
Same package: mistralai CVE-2026-87983 Mistral Vibe: quoted paths bypass file read guard
Same package: mistralai GHSA-jgg6-4rpr-wfh7 Mistral npm SDK: supply chain attack, no impact
Same package: mistralai