CRITICAL 9.3 NVD
CVE-2026-87984
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.
References
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-11 via NVD.
Risk Timeline
CVE Disclosed2026-09-11 · -1 days ago
Remediation Resources
Official Advisory
www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe2
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.