CVE-2026-87987: Mistral AI env-var trick bypasses

CISO Take

Mistral Vibe, an AI coding agent, enforces a permission gate that blocks unapproved shell commands but fails to inspect environment-variable assignments prepended to an otherwise allowlisted command, letting an attacker smuggle variables like LD_PRELOAD or PYTHONPATH that hijack execution the moment the 'safe' command runs. Because the check happens before code execution and the bypass requires no user approval, any workflow where Vibe can be steered into emitting a crafted command line — including via indirect prompt injection from a malicious repo, file, or webpage the agent reads — can escalate straight to arbitrary code execution on the developer's or CI machine. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit/scanner coverage yet, but the vendor advisory (HiddenLayer) rates it critical, and with 472 downstream dependents and 8 other known CVEs in the same package, the blast radius spans a meaningful slice of teams running agentic coding workflows. Patch to the fixed version as soon as it's published; until then, disable command auto-approval entirely or wrap execution in a validator that rejects any command string containing an `=` token before the first whitespace-delimited word, and strip/normalize the environment (no LD_PRELOAD/PYTHONPATH/NODE_OPTIONS propagation) before any approved command reaches a shell. Detection teams should hunt process-creation logs for coding-agent processes spawning children with unexpected preload or interpreter-path environment variables.

Sources: NVD ATLAS hiddenlayer.com

What is the risk?

Rated critical by the vendor despite no published CVSS vector, EPSS score, KEV listing, or public PoC/scanner coverage — exploitability today depends on an attacker gaining a path to influence the command string the agent constructs (e.g., via indirect prompt injection or a compromised upstream data source the agent trusts), which is a known and increasingly common attack surface for coding agents rather than a novel research problem. Impact is severe: successful exploitation yields unauthenticated, unapproved arbitrary code execution in the context of the developer's or CI environment, defeating the entire purpose of the permission/allowlist control. Exposure is amplified by the fact that agentic coding tools are typically run with elevated local or CI privileges and are increasingly embedded in day-to-day developer workflows, and this package already carries 8 other known CVEs, suggesting a broader pattern of security debt.

How does the attack unfold?

Crafted command preparation

Attacker (directly or via injected content the agent trusts) constructs a command string that prepends an environment-variable assignment to an otherwise allowlisted command name.

AML.T0102

Permission check evasion

Mistral Vibe's allowlist checker inspects only the trailing command name and approves the full string without flagging or stripping the leading environment assignment.

AML.T0107

Auto-execution

The agent executes the approved-looking command through the shell without requesting user confirmation, and the shell applies the injected environment variable before running the target executable.

AML.T0050

Code execution / machine compromise

The injected environment variable (e.g., a preload or interpreter-path variable) causes attacker-controlled code to load and run with the privileges of the developer's session or CI runner.

AML.T0112.000

Crafted command preparation

Attacker (directly or via injected content the agent trusts) constructs a command string that prepends an environment-variable assignment to an otherwise allowlisted command name.

AML.T0102

Permission check evasion

Mistral Vibe's allowlist checker inspects only the trailing command name and approves the full string without flagging or stripping the leading environment assignment.

AML.T0107

Auto-execution

The agent executes the approved-looking command through the shell without requesting user confirmation, and the shell applies the injected environment variable before running the target executable.

AML.T0050

Code execution / machine compromise

The injected environment variable (e.g., a preload or interpreter-path variable) causes attacker-controlled code to load and run with the privileges of the developer's session or CI runner.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
767 478 dependents Pushed 8d ago 0% patched Full package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Patch Mistral Vibe to the version that resolves this advisory as soon as it is released — track the HiddenLayer advisory for the fixed release. 2) Until patched, disable command auto-approval/allowlisting entirely and require explicit manual approval for every shell command the agent proposes. 3) If auto-approval must stay on, front it with a strict parser that rejects any proposed command containing a NAME=value token before the first whitespace-delimited executable name. 4) Run agent-initiated shell execution inside a sandbox with a minimal, explicitly-allowlisted environment (drop LD_PRELOAD, PYTHONPATH, NODE_OPTIONS, GIT_SSH_COMMAND, etc. unless explicitly required) and least-privilege filesystem access. 5) Detection: alert on child processes spawned by the agent that carry unexpected preload/interpreter-path environment variables, and audit historical command logs for env-var-prefixed invocations of allowlisted commands.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0102 - Generate Malicious Commands AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-87987?

Mistral Vibe, an AI coding agent, enforces a permission gate that blocks unapproved shell commands but fails to inspect environment-variable assignments prepended to an otherwise allowlisted command, letting an attacker smuggle variables like LD_PRELOAD or PYTHONPATH that hijack execution the moment the 'safe' command runs. Because the check happens before code execution and the bypass requires no user approval, any workflow where Vibe can be steered into emitting a crafted command line — including via indirect prompt injection from a malicious repo, file, or webpage the agent reads — can escalate straight to arbitrary code execution on the developer's or CI machine. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit/scanner coverage yet, but the vendor advisory (HiddenLayer) rates it critical, and with 472 downstream dependents and 8 other known CVEs in the same package, the blast radius spans a meaningful slice of teams running agentic coding workflows. Patch to the fixed version as soon as it's published; until then, disable command auto-approval entirely or wrap execution in a validator that rejects any command string containing an `=` token before the first whitespace-delimited word, and strip/normalize the environment (no LD_PRELOAD/PYTHONPATH/NODE_OPTIONS propagation) before any approved command reaches a shell. Detection teams should hunt process-creation logs for coding-agent processes spawning children with unexpected preload or interpreter-path environment variables.

Is CVE-2026-87987 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87987, increasing the risk of exploitation.

How to fix CVE-2026-87987?

1) Patch Mistral Vibe to the version that resolves this advisory as soon as it is released — track the HiddenLayer advisory for the fixed release. 2) Until patched, disable command auto-approval/allowlisting entirely and require explicit manual approval for every shell command the agent proposes. 3) If auto-approval must stay on, front it with a strict parser that rejects any proposed command containing a `NAME=value` token before the first whitespace-delimited executable name. 4) Run agent-initiated shell execution inside a sandbox with a minimal, explicitly-allowlisted environment (drop LD_PRELOAD, PYTHONPATH, NODE_OPTIONS, GIT_SSH_COMMAND, etc. unless explicitly required) and least-privilege filesystem access. 5) Detection: alert on child processes spawned by the agent that carry unexpected preload/interpreter-path environment variables, and audit historical command logs for env-var-prefixed invocations of allowlisted commands.

What systems are affected by CVE-2026-87987?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants, CI/CD-integrated AI agents.

What is the CVSS score for CVE-2026-87987?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistantsCI/CD-integrated AI agents

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0102 Generate Malicious Commands

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

Exploitation Scenario

A developer asks their Mistral Vibe agent to review a pull request or summarize a README that contains attacker-planted content (indirect prompt injection). The injected instructions tell the agent that, as a 'diagnostic step,' it should run something like `LD_PRELOAD=/tmp/payload.so ls -la`. Vibe's permission layer inspects the string, matches the trailing `ls -la` against its allowlist, and executes the full command without prompting the user for approval. The shell resolves the environment assignment before exec'ing `ls`, loading the attacker's shared object into the process and achieving arbitrary code execution with the privileges of the developer's session or the CI runner — with zero explicit user consent and no indication anything unusual occurred beyond a normal 'safe' command running.

Weaknesses (CWE)

CWE-15 External Control of System or Configuration Setting

CWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Source: MITRE CWE corpus.