CVE-2026-87987 Command injection in mistral-vibe
Attackers can bypass command permission checks in Mistral Vibe via environment variable assignments, leading to arbitrary code execution without user approval.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87987?
CVE-2026-87987 is a critical command injection vulnerability in mistralai mistral-vibe, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
Weakness: CWE-15
Which versions are affected by CVE-2026-87987?
How do I fix CVE-2026-87987?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-87987 being exploited?
There is no known exploitation of CVE-2026-87987 in the wild and no public exploit code.
Sources
Also known as GHSA-r6r3-x5p3-g7m8.