CVE-2026-87986

critical · 10

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2026-09-11

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-228

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-87986