CVE-2026-87984CWE-22path-traversal

CVE-2026-87984

published September 11, 2026

CVSS
9.3
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00496 · 41.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-11T19:17Z
References (1)
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe2 · 6f8de1f0-f67e-45a6-b68f-98777fdb759c
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:24Z
    An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active…
    cvelistv5