CVE-2026-87988: Mistral AI unvalidated paths let

CISO Take

Mistral Vibe, an AI coding agent, ships a set of commands marked as 'unconditionally allowed' that skip the path-validation checks enforcing its workspace sandbox, letting an attacker read files anywhere on the host without user approval. This matters because coding agents routinely run with access to developer machines and CI runners holding SSH keys, cloud credentials, and .env secrets — an out-of-sandbox file read here is a direct path to credential theft, not a theoretical edge case. There's no evidence of active exploitation (absent from CISA KEV, no public PoC, no Nuclei template), but the vendor rated it critical and the flaw sits in a trust boundary — the workspace sandbox — that users rely on when granting the agent broad filesystem access; 472 downstream dependents widen the blast radius if this pattern recurs in forks or similar agents. Patch to the version specified in HiddenLayer's advisory as soon as it's available, and in the interim restrict Vibe to disposable/sandboxed environments (containers, VMs) rather than developer machines with credential material, and audit which commands your deployment treats as 'unconditionally allowed'.

Sources: hiddenlayer.com CISA KEV ATLAS

What is the risk?

Rated critical by the vendor and consistent with that rating given the trust model of AI coding agents: the vulnerability defeats the core isolation guarantee (the workspace boundary) that governs unattended file access. Exploitability is currently unconfirmed in the wild — no CISA KEV listing, no public exploit code, no Nuclei template, and EPSS/CVSS data are not yet published — so treat this as high-severity-but-unproven-exploitation rather than an imminent mass-exploitation event. The realistic risk driver is that 'unconditionally allowed' commands are, by design, invoked without confirmation, so any path that reaches them (whether from a malicious instruction, a poisoned repo, or attacker-controlled input) bypasses the safety check entirely rather than requiring a complex chain.

How does the attack unfold?

Entry point

Adversary delivers a malicious instruction via a poisoned repository, file, or prompt that asks Vibe to invoke one of its 'unconditionally allowed' commands with an attacker-supplied path.

AML.T0053

Exploitation

Vibe skips path validation for the command class, executing it against a path outside the active workspace without user approval.

AML.T0107

Impact

The agent reads and returns file contents outside the workspace — such as SSH keys, cloud credentials, or .env secrets — giving the adversary access to sensitive host data.

AML.T0037

Entry point

Adversary delivers a malicious instruction via a poisoned repository, file, or prompt that asks Vibe to invoke one of its 'unconditionally allowed' commands with an attacker-supplied path.

AML.T0053

Exploitation

Vibe skips path validation for the command class, executing it against a path outside the active workspace without user approval.

AML.T0107

Impact

The agent reads and returns file contents outside the workspace — such as SSH keys, cloud credentials, or .env secrets — giving the adversary access to sensitive host data.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Mistral AI	pip	—	No patch
767 478 dependents Pushed 8d ago 0% patched Full package profile →

Do you use Mistral AI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Apply the vendor patch referenced in the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe6) as soon as a fixed version is published — no patched version is specified yet, so monitor the advisory for updates. Until patched, run Vibe inside disposable, credential-minimal environments (ephemeral containers/VMs) rather than developer laptops or CI runners holding long-lived secrets, and avoid storing sensitive credentials in locations reachable from the agent's execution context. Review and, where possible, restrict or disable the set of commands classified as 'unconditionally allowed' in your Vibe configuration. For detection, monitor file-access logs (auditd/EDR) for Vibe process activity touching paths outside the active workspace directory, and alert on reads of credential files (~/.ssh, ~/.aws, .env) by the agent process.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-87988?

Mistral Vibe, an AI coding agent, ships a set of commands marked as 'unconditionally allowed' that skip the path-validation checks enforcing its workspace sandbox, letting an attacker read files anywhere on the host without user approval. This matters because coding agents routinely run with access to developer machines and CI runners holding SSH keys, cloud credentials, and .env secrets — an out-of-sandbox file read here is a direct path to credential theft, not a theoretical edge case. There's no evidence of active exploitation (absent from CISA KEV, no public PoC, no Nuclei template), but the vendor rated it critical and the flaw sits in a trust boundary — the workspace sandbox — that users rely on when granting the agent broad filesystem access; 472 downstream dependents widen the blast radius if this pattern recurs in forks or similar agents. Patch to the version specified in HiddenLayer's advisory as soon as it's available, and in the interim restrict Vibe to disposable/sandboxed environments (containers, VMs) rather than developer machines with credential material, and audit which commands your deployment treats as 'unconditionally allowed'.

Is CVE-2026-87988 actively exploited?

No confirmed active exploitation of CVE-2026-87988 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87988?

Apply the vendor patch referenced in the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe6) as soon as a fixed version is published — no patched version is specified yet, so monitor the advisory for updates. Until patched, run Vibe inside disposable, credential-minimal environments (ephemeral containers/VMs) rather than developer laptops or CI runners holding long-lived secrets, and avoid storing sensitive credentials in locations reachable from the agent's execution context. Review and, where possible, restrict or disable the set of commands classified as 'unconditionally allowed' in your Vibe configuration. For detection, monitor file-access logs (auditd/EDR) for Vibe process activity touching paths outside the active workspace directory, and alert on reads of credential files (~/.ssh, ~/.aws, .env) by the agent process.

What systems are affected by CVE-2026-87988?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding assistants/CLI tools.

What is the CVSS score for CVE-2026-87988?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI coding assistants/CLI tools

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

Exploitation Scenario

An adversary plants a malicious instruction inside a repository or document that a developer opens with Mistral Vibe — for example, a README or code comment containing a hidden instruction to 'run diagnostics' via one of the unconditionally-allowed commands, but crafted with a path argument pointing outside the workspace (e.g., ~/.ssh/id_rsa or ~/.aws/credentials). Because that command class skips path validation and requires no user approval, Vibe executes it as instructed, reads the file, and returns its contents in the agent's output or a subsequent action, where the attacker can retrieve it — all without the developer noticing anything beyond a normal-looking agent response.

Weaknesses (CWE)

CWE-732 Incorrect Permission Assignment for Critical Resource

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.