CRITICAL 10.0 NVD
CVE-2026-87987
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments precedin
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.
References
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-09-11 via NVD.
Risk Timeline
CVE Disclosed2026-09-11 · -1 days ago
Remediation Resources
Official Advisory
www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.