CVE-2026-87984
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user app…
Published: 2026-09-11 · CVSS: 9.3 · CVSS 4.0
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7