VulnSocial

CVE-2026-87987Disclosure

MEDIUMCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-15

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 2 mentions (2026-09-24); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-09-12: 1Mentions · 2026-09-24: 2Mentions · 2026-10-04: 1Mentions · 2026-10-12: 1PoC Mentioned / Linked · 2026-09-24: 1Exploit Tool / Code · 2026-09-24: 1Patch / Workaround · 2026-09-24: 1Patch / Workaround · 2026-10-04: 1Patch / Workaround · 2026-10-12: 1Technical Details · 2026-09-12: 1Technical Details · 2026-09-24: 1Technical Details · 2026-10-04: 1Technical Details · 2026-10-12: 109-1209-2410-0410-12
Signal classification3 categories
Disclosure
240.0%
Patch
240.0%
PoC
120.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-121
Disclosure1
2026-09-242
Disclosure1PoC1
2026-10-041
Patch1
2026-10-121
Patch1
Full discourse5 posts
  • Maxime Rossi Bellom@max_r_b
    Disclosure

    @secmatedev found two vulnerabilities in Mistral Vibe: arbitrary code execution and file access outside the workspace, both without the approval prompt users rely on. Full chain, from malicious repo to stolen Mistral token: https://blog.secmate.dev/posts/mistral-vibe-cve-2026-87987-cve-2026-87984/ https://t.co/Px5lAOqfR3

    Post summary

    The tweet discloses two vulnerabilities in Mistral Vibe—arbitrary code execution and file access outside the workspace—detailing an attack chain that could lead to token theft, without mentioning any patches, exploits, or active exploitation.

    11050656
    930 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 Mistral Vibe'da 6 kritik güvenlik açığı! Mistral AI'nin kodlama ajanı Mistral Vibe'da CVE-2026-87983/84/85/86/87/88 numaralı 6 güvenlik açığı tespit edildi. 🔴 3 açık doğrudan RCE'ye yol açabiliyor: • CVE-2026-87985 • CVE-2026-87986 • CVE-2026-87987 Diğer açıklar ise workspace izolasyonunun aşılmasıyla arbitrary file read/write yapılmasına izin verebiliyor. Özellikle agent'ın komut izin/allowlist mekanizmasının bypass edilebilmesi dikkat çekiyor. ⚠️ Şu an için bu CVE'ler için vendor tarafından açıklanmış net bir fixed version bulunmuyor.

    Post summary

    Six new CVEs in Mistral AI’s Mistral Vibe were announced, three of which can directly lead to remote code execution, while the others enable arbitrary file access and allowlist bypass, with no available patch or fixed version reported.

    00021399
    2.4K followersView on X
  • Maxime Rossi Bellom@max_r_b
    PoC

    @MistralAI released fixes in Vibe 2.25.8. Thanks to their security team for the prompt action and for coordinating with us. Write-up: https://blog.secmate.dev/posts/mistral-vibe-cve-2026-87987-cve-2026-87984/ PoC: https://github.com/SecMateDev/mistral-vibe-attack-demo

    Post summary

    The tweet announces the release of fixes for two CVEs in Mistral Vibe version 2.25.8 and publicly shares a Proof of Concept exploit repository demonstrating the vulnerabilities.

    00020106
    930 followersView on X
  • Shreyansh Sancheti@shrey_sancheti
    Patch

    Mistral Vibe CVE-2026-87987: the approval check read a reduced parse of the command, but the shell ran the raw string. An env assignment before cat got dropped, so no prompt and a repo-controlled cat ran. Fixed in 2.25.4: unmodeled syntax needs approval. #AISecurity #AppSec

    Post summary

    The text describes CVE-2026-87987 as a command injection vulnerability in Mistral Vibe caused by a parse/shell execution mismatch, and explicitly names version 2.25.4 as the fixed release.

    0000052
    167 followersView on X
  • Swif@swif_ai
    Patch

    Mistral Vibe vetted shell commands via a parsed copy but ran the raw string, so a PATH= prefix let a repo's fake cat pass as allowlisted and run unprompted. Update to 2.25.8+. Approve what executes. https://blog.secmate.dev/posts/mistral-vibe-cve-2026-87987-cve-2026-87984/

    Post summary

    The post describes a Mistral Vibe allowlist bypass/command execution issue (CVE-2026-87987, CVE-2026-87984) and explicitly advises updating to version 2.25.8+.

    0000036
    69 followersView on X

Explore more

Back to dashboard