CVE-2026-87985
An attacker can run any code on a system that uses Mistral Vibe by sending specially crafted ANSI‑C quoted arguments. The vulnerability lets the attacker bypass normal command permission checks, allowing them to execute arbitrary commands without approval.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Mistral Vibe, regardless of version, are affected because the product’s command handling does not properly validate quoted arguments.
Real-world impact
An attacker could take full control of a victim’s machine, install malware, exfiltrate data, or use the system as part of a larger attack chain, all without needing any user interaction.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable remotely, requires no authentication, and gives an attacker complete control over the affected system. All impact metrics (confidentiality, integrity, availability) are rated high, and the attack vector is network‑based.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources