CVE-2026-87987

Mistral Vibe, Mistral AI's agentic coding CLI, fails to inspect environment-variable assignments that precede a command when validating it against the user's command allowlist (CWE-15). An attacker who can influence the commands the agent executes can prepend attacker-controlled environment variable assignments to an allowlisted command; because those assignments are excluded from inspection, they can load or invoke attacker-controlled code while the user only sees an approved command. Successful exploitation yields arbitrary code execution on the machine running Vibe with the agent's privileges, without the user's explicit approval of the extra code path, which is consistent with the CVSS 4.0 10.0 (critical) rating of network exploitability with no privileges or user interaction required. Only users running Mistral Vibe are affected; there is no indication of internet-facing service exposure. No public proof-of-concept, confirmed in-the-wild exploitation, or CISA KEV listing is known.

What to do: Update Mistral Vibe to the vendor's patched release as soon as one is announced; no fixed version is given in the available data, so monitor Mistral AI's advisory for the fixed version. Until patched, treat commands with leading environment-variable assignments with suspicion, review the full command string (not just the allowlisted command name) before approving, and avoid auto-approving allowlisted commands when working with untrusted repositories or task instructions. Also review recent Vibe sessions on sensitive machines for any approved commands that carried unexpected environment-variable prefixes.