CVE-2026-87985: Mistral Vibe arbitrary code execution via ANSI-C quoted arguments

Executive brief

Mistral Vibe is an AI code execution environment that automatically approves commands deemed safe. A vulnerability allows attackers to hide dangerous command arguments (like -exec for find) using ANSI-C quoting syntax, bypassing permission checks while Bash restores and executes the hidden arguments. An attacker can trick the system into running arbitrary commands with the user's privileges.

Technical details

This is an incomplete input validation vulnerability (CWE-184) in Mistral Vibe's permission checking logic. The _extract_commands() function reconstructs shell commands from tree-sitter AST nodes to verify them against a permission policy, but it fails to include ansi_c_string node types in its reconstruction. An attacker can express dangerous find predicates (e.g., -exec) using ANSI-C quoting syntax ( ...'), which causes Vibe's checks to see a benign find command while Bash's runtime expansion restores the true dangerous arguments. This enables arbitrary code execution with Vibe's privileges, particularly through indirect prompt injection in LLM-generated commands. The attack requires no authentication or user interaction beyond an LLM prompt. A fix is available by including ansi_c_string nodes in command argument extraction.

Affected products

• Mistral AI Vibe v2.9.0 and later

Timeline

• 2026-09-11: disclosed

References

• https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe3