CVE-2026-87988
Mistral Vibe has a flaw that lets attackers read or write any file on the server, ignoring workspace boundaries. The bug is caused by missing path validation for commands that are always allowed. Because the attacker can access critical files, the vulnerability is rated as critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mistral Vibe (any version, as no specific versions are listed).
Real-world impact
An attacker could read sensitive configuration files, modify application data, or inject malicious code by accessing files outside the intended workspace, potentially taking full control of the system.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network, requires no user interaction, and gives the attacker complete control over the system, with high confidentiality, integrity, and availability impact.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources