CVE-2026-87986: Mistral Vibe: shell parser bypass enables unapproved RCE

Mistral Vibe, an AI coding agent, is supposed to gate shell command execution behind a user permission check, but a parser weakness means it silently drops shell constructs it cannot interpret before running that check — so an attacker can hide malicious commands inside syntax the approval logic never sees, letting arbitrary code execute without the user ever consenting. With 472 downstream dependents and no patched version currently listed, the blast radius spans any developer or pipeline that trusts Vibe's approval prompts as a safety boundary. There is no CISA KEV listing, no public exploit, and no EPSS score yet, so this looks pre-exploitation rather than actively weaponized — but the vulnerability class (a confused-deparser bypass of an agent's own safety gate, CWE-228) is exactly the kind of flaw that gets weaponized fast once researchers publish proof-of-concept payloads, especially given the vendor advisory is already public via HiddenLayer. Treat this as an urgent action item: pin or disable Vibe's autonomous command execution until a fix ships, monitor the vendor advisory for a patched release, and in the meantime review shell command logs from any host running Vibe for constructs (unusual quoting, escaped delimiters, embedded subshells) that wouldn't normally appear in legitimate developer workflows.

No confirmed active exploitation of CVE-2026-87986 has been reported, but organizations should still patch proactively.

1) Check the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4) and Mistral Vibe's changelog for a patched release; upgrade immediately once available. 2) Until patched, disable or heavily restrict Vibe's autonomous shell/command execution feature, or run it only inside a disposable, network-isolated sandbox/container with no access to sensitive credentials or production systems. 3) Do not treat the approval prompt as a sufficient security boundary — apply OS-level command allowlisting or a mediating shell wrapper that independently validates the full command string rather than trusting the agent's own parsed representation. 4) Detection: audit shell/process execution logs on hosts running Vibe for command strings containing unusual shell metacharacters, nested quoting, command substitution (`$()`, backticks), or multi-statement separators that don't match the command the user believes they approved. 5) Treat this as a supply-chain-adjacent risk — restrict Vibe usage to trusted repositories/prompts until confidence in the fix is established.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants / dev tooling, local AI agents with shell/tool execution.

No CVSS score has been assigned yet.