Mistral Vibe: six CVEs say allowlists aren't sandboxes

If your team runs Mistral Vibe, the approval prompt you have been clicking through is not a security boundary. HiddenLayer published six CVEs against the coding agent on September 11. Four of them scored a CVSS 4.0 of 10.0. They are six variations of one bug: the command allowlist inspects a string, and then bash executes something different.

What actually happened

HiddenLayer filed the records as its own CNA against mistralai/mistral-vibe. The mechanics are worth reading in full, because the pattern is not Mistral-specific.

CVE-2026-87985 (10.0) is the cleanest example. Vibe parses a proposed command with tree-sitter to decide whether it needs approval. Write a dangerous find predicate in ANSI-C quoting — $'-exec' instead of -exec — and the parser produces an ansi_c_string node that _extract_commands() never inspects. Bash restores the argument at runtime. An approved command becomes arbitrary code execution, and HiddenLayer's advisory notes it is reachable through indirect prompt injection. Affected: v2.9.0 and later.

The rest rhyme. CVE-2026-87987 (10.0): environment-variable assignments placed before an allowlisted command are excluded from inspection. CVE-2026-87986 (10.0): shell constructs the parser cannot interpret go uninspected entirely. CVE-2026-87988 (10.0): unconditionally-allowed commands skip path validation, so the workspace fence does not hold. CVE-2026-87984 (9.3): shell redirection targets are omitted from permission checks — arbitrary file write. CVE-2026-87983: quoted absolute paths read files outside the workspace.

As of this writing the project's GitHub security advisories page is empty and none of the six records names a fixed version. Treat "upgrade" as advice you cannot yet act on precisely.

Why it matters for your business

Here is the durable lesson, and it applies to every coding agent you run, not just this one. An allowlist that works by parsing a command string is a second implementation of bash — and it will always be a worse one than bash. Two parsers, one execution. The gap between them is the vulnerability, and there is no version of this design where that gap closes permanently.

So stop buying the boundary and start building it somewhere real:

Put the agent in a container, not in a prompt. The thing that should stop an agent from reading ~/.aws/credentials is that the file is not in the container, not that a regex declined to approve cat.

Assume prompt injection is the delivery mechanism. Your agent reads issues, READMEs, dependency changelogs, and scraped pages. Any of those can carry the payload. The attacker does not need your keyboard.

Scope the credentials the agent actually holds. A deploy token that can only touch one staging project turns a CVSS 10 into an incident report instead of a breach.

Sources: HiddenLayer Security Advisory, OpenCVE CVE-2026-87985.