CVE-2026-87983CWE-22path-traversal

CVE-2026-87983

published September 11, 2026

CVSS
9.2
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00623 · 49.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-11T19:17Z
References (1)
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe · 6f8de1f0-f67e-45a6-b68f-98777fdb759c
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:22Z
    An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute…
    cvelistv5