CVE-2026-87986
An attacker can run arbitrary commands on a system running Mistral Vibe by exploiting a flaw that lets them bypass command permission checks. The vulnerability allows the attacker to inject shell commands that the parser ignores, leading to full code execution. No public exploit or patch is currently available.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mistral Vibe (specific versions not listed in the data).
Real-world impact
An attacker could execute any command on the victim’s machine, potentially taking full control, installing malware, or exfiltrating data.
Why this severity
The CVSS score of 10 reflects the vulnerability’s ability to provide complete code execution with no authentication or user interaction required, and the lack of any mitigations or workarounds.
What to do about it
- ›Monitor for vendor updates and apply any future patches as soon as they become available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources