Mistral Vibe: Bash permission bypass via hidden command substitution
Summary
Mistral Vibe, a terminal coding assistant, has a flaw in its shell permission check. The static analysis misses a command substitution hidden in a single-quoted variable, which bash later expands with the ${var@P} operator, so only the trailing allowlisted command is checked. An attacker who gets crafted input processed by the agent, for example from a repository or file, can run arbitrary commands silently with the privileges of the agent's terminal session.
Affected
- Mistral Vibe versions before 2.25.4
Fixed in
- Fixed in Mistral Vibe 2.25.4 (commit 19b5b74, PR #1084)
Workaround
- Keep approval prompts enabled. Automatic approval modes bypass these permission checks.
- Monitor for unexpected shell processes and file access by the agent.
Exploitation
- No exploitation in the wild is known.
- No public proof of concept has been confirmed.
Our recommendation
- Update Mistral Vibe to version 2.25.4 or later.
- Until the update is done, do not use auto-approve modes on systems with sensitive data.
- Review agent activity logs and endpoint telemetry for unexpected commands and file access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck, via OSV) osv.dev
- VulnCheck advisory www.vulncheck.com
- Fix commit 19b5b74 github.com
- Pull request #1084 github.com
- Release v2.25.4 github.com
- Mistral security advisory MAI-2026-003 docs.mistral.ai
- NVD mirror (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:22.
Original description (NVD)
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.
NVD references (4)
- https://github.com/mistralai/mistral-vibe/commit/19b5b74faa78d0816b8d4d4c7d7543fc3520678c
- https://github.com/mistralai/mistral-vibe/pull/1084
- https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.4
- https://www.vulncheck.com/advisories/mistral-vibe-bash-permission-bypass-via-var-p-prompt-transform
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.