Mistral patches six Vibe shell-permission bypasses in version 2.25.4

Mistral says Vibe 2.25.4, released on 12 September, fixes six vulnerabilities in the CLI's shell-permission checks, CVE-2026-87983 through CVE-2026-87988. The affected code sits between an agent-generated command and the approval prompt that is supposed to appear when a command falls outside the allowed policy.

The reports expose the same broad failure mode from different angles: Vibe could inspect one interpretation of a command while Bash or Zsh later executed a more powerful one. Quoting, redirection, environment assignments, parser error nodes and command options could therefore change what the shell did after the permission check had already decided that no prompt was required.

HiddenLayer's advisories describe six routes around the checks. One used quoted absolute paths to reach files outside the workspace. Another omitted shell redirection targets from path validation. ANSI-C quoting could hide dangerous arguments, while shell constructs that tree-sitter-bash represented as errors could leave executable behaviour outside Vibe's inspection. Environment assignments were also stripped before approval decisions, and an expanded read-only command allowlist exposed paths and options that were not consistently constrained.

Mistral says the resulting commands could read credentials or source code outside the workspace, create or overwrite files elsewhere on the host, or execute code with the permissions of the user running Vibe. The affected range differs by CVE: the oldest reported variants date back to version 1.3.4, and CVE-2026-87988 received partial fixes in 2.20.0 and 2.23.0 before the remaining reported option bypasses were closed in 2.25.4.

Mistral's advisory says malicious instructions in content processed by the agent could cause crafted commands to be issued. SecMate's follow-up analysis describes repository-based delivery as one realistic route, where attacker-controlled project content influences the model before the vulnerable Bash tool receives the generated command.

The published CVSS vectors describe severe technical impact, but they do not establish that an arbitrary internet user can directly reach a local Vibe process. The practical route depends on how an attacker influences the agent's input and which files, credentials and operating-system permissions are available to the Vibe process when a bypassed command runs.

Mistral's advisory recommends upgrading to Vibe 2.25.4 or later and says that release closes the six reported CVE variants. The 2.25.4 release notes likewise say shell permission checks now require approval for risky syntax and command options associated with CVE-2026-87984 through CVE-2026-87988.

SecMate updated its analysis after reviewing later releases and says 2.25.5, 2.25.7 and 2.25.8 added further permission-bypass hardening. It recommends 2.25.8 or later. That does not change Mistral's account of the original six CVEs, but it means operators should prefer the newer release rather than treating 2.25.4 as the final word on the approval boundary.

Running an affected version does not by itself show that a machine was compromised. Mistral says the public examples are proofs of concept rather than a single malware campaign and recommends reviewing Vibe tool-call records and endpoint telemetry for unexpected file access, file changes or shell processes when exploitation is suspected. The cited sources do not report exploitation in the wild.