CVE-2026-87988

critical · 10

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

CVSS

0.4%

EPSS (exploit prob.)

37th

EPSS percentile

2026-09-11

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-732

References

https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe6

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-87988