CVE-2026-87986CWE-228

CVE-2026-87986

published September 11, 2026

CVSS
10.0
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-228 · Improper Handling of Syntactically Invalid Structure
Published
2026-09-11T19:17Z
References (1)
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4 · 6f8de1f0-f67e-45a6-b68f-98777fdb759c
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:31Z
    An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot…
    cvelistv5