CVE-2026-87984

Mistral Vibe, a developer coding agent tool, contains an arbitrary file write vulnerability introduced in version 1.3.4 (CWE-22, path traversal). The flaw arises because the destinations of shell redirections are omitted from Vibe's permission checks, so commands that are normally allowlisted can write to paths outside the active workspace without prompting the user for approval. An attacker who can influence the commands or their redirection targets can create or overwrite any file accessible to the Vibe process, potentially corrupting configuration, startup, or other sensitive files depending on the process's privileges. Anyone running Vibe version 1.3.4 or later is affected. There is no evidence of exploitation so far: the flaw is not in CISA's KEV and no public proof-of-concept is known.

What to do: Upgrade Vibe to the latest available release once a patched version is published, since no fixed version number is confirmed in the available data. Until then, treat shell redirection targets in allowlisted commands as untrusted, audit workspaces and host directories for files created or modified outside the workspace, and run Vibe with least-privilege file permissions to limit what an arbitrary write can touch.