Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path vali

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HiddenLayer

Description

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

mistralai mistral-vibe

Default version status: unaffected

  • 2.15.0 to ≤ *affected

References