Mistral Vibe: two CVEs let crafted shell input bypass command permission checks

Vulnerability · Mistral Vibe · HIGH

Incident dateNot stated

DisclosedOct 13, 2026 (NVD, both CVEs). Fixes released Sep 12 and Sep 18, 2026.

Added hereOct 14, 7:35 AM ET

Last verifiedOct 14, 2026

Summary

NVD published two CVEs from VulnCheck for Mistral Vibe, Mistral's coding agent. In both, a crafted shell command looked like an allowlisted command to Vibe's permission check, while bash actually ran a different, hidden command. One is fixed in 2.25.4, the other in 2.25.5. VulnCheck scores both 8.7 High (CVSS 4.0) and credits Minqiang Gui.

Severity

HIGH Silent command execution with the privileges of the agent's terminal session, past the permission gate meant to stop it. Scored 8.7 High (CVSS 4.0) and 8.8 High (CVSS 3.1) by VulnCheck. Both fixed.

Timeline

Sep 12, 2026
Mistral Vibe v2.25.4 released, fixing CVE-2026-109429.
Sep 18, 2026
Mistral Vibe v2.25.5 released, fixing CVE-2026-109428.
Oct 13, 2026 (NVD)
CVE-2026-109429: before 2.25.4, a command substitution hidden in a single-quoted variable and re-expanded with bash's ${var@P} prompt-transform ran at runtime, while only the trailing allowlisted command was classified.
Oct 13, 2026 (NVD)
CVE-2026-109428: before 2.25.5, tree-sitter-bash and bash handled backslash-newline line continuations differently. Vibe saw only an allowlisted prefix such as cd and granted permission, while bash joined the lines into a different command, such as a curl request.

How it happened

Vibe decides whether a command is allowed by parsing it with tree-sitter-bash. Bash itself does not always read the command the same way. Each CVE is a case where the two disagree, so the check approved one command and bash ran another. NVD lists both as CWE-436 (Interpretation Conflict). Coding agents that allowlist shell commands by parsing them can fail the same way whenever their parser and the real shell differ.

How to check your app

Update Mistral Vibe to 2.25.5 or later, which covers both fixes.
Keep approval prompts on when the agent reads files, issues or web pages you did not write.
Do not treat an allowlisted command as safe on its own; review what actually runs.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.