CVE-2026-87987CWE-15

CVE-2026-87987

published September 11, 2026

CVSS
10.0
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-15 · External Control of System or Configuration Setting
Published
2026-09-11T19:17Z
References (1)
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5 · 6f8de1f0-f67e-45a6-b68f-98777fdb759c
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:34Z
    An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments…
    cvelistv5