Executive brief
Mistral Vibe is a command execution tool that checks and approves shell commands before running them. An attacker can exploit a parser limitation to hide unauthorized commands inside shell syntax that Vibe's parser cannot understand, causing those commands to execute without user approval. This allows arbitrary code execution on systems using Vibe for command authorization.
Technical details
The vulnerability stems from improper handling of syntactically invalid shell constructs in Vibe's command parser (CWE-228). Vibe uses tree-sitter-bash to parse shell commands for authorization checks, but when the parser encounters unsupported Bash or Zsh syntax, it wraps it in ERROR nodes and continues. The find_commands() function only extracts commands from successfully parsed nodes, missing executable content hidden in ERROR nodes. An attacker can use Bash brace expansion (e.g., {/bin/bash,-c,id}) or Zsh anonymous functions (e.g., (){ /bin/bash -c id }) as command substitutions within allowlisted commands like echo. The underlying shell still executes the hidden command while Vibe's approval logic only sees the benign outer command. This bypass requires no authentication or user interaction beyond issuing a crafted command. The recommended fix is to require explicit user approval whenever ERROR nodes appear in the parse tree, rather than trusting incomplete parse results.
Affected products
- Mistral Vibe v1.3.4 and later
Timeline
- 2026-09-11: disclosed