CVE-2026-87988CWE-732

CVE-2026-87988

published September 11, 2026

CVSS
10.0
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-11T19:17Z
References (1)
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe6 · 6f8de1f0-f67e-45a6-b68f-98777fdb759c
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 14:35Z
    An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally…
    cvelistv5