CVE-2026-87988: Mistral Vibe Arbitrary Read/Write via Discrepancy Between Auto-Approved Commands and Path Control List

HERMES

HERMES THREAT SCORE & WHITELIST SYNCHRONIZATION BREAKDOWN

Target: Mistral Vibe Coding Agent (mistral-vibe)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 18 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v4.0 evaluates CVE-2026-87988 at a maximum 10.0 (Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The Hermes Threat Score assesses this vulnerability at 98 (CRITICAL). This reflects architectural authorization drift where expanding an auto-approval whitelist without matching path-containment controls allows unprompted read and write operations across the entire operating system.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87988: Mistral Vibe Arbitrary Read/Write via Discrepancy Between Auto-Approved Commands and Path Control ListVULNERABILITY

Connected Nodes: 4

Active Relationships (Outgoing)

→ affectsPRODUCTMistral Vibe Coding Agent

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Mistral Vibe Coding Agent documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-002: Indirect Context Injection

92% VERY_HIGH

Adversary embeds covert payload instructions into retrieved external data (web pages, repositories, emails) that subvert model planning when parsed by autonomous agents.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87988 weaponizes the agentic attack pattern formalized under AAP-002.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass

92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87988 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-001: Direct System Prompt Override

92% VERY_HIGH

Adversary injects explicit formatting tags or role-inversion prompts directly into user input to strip system instructions and escape developer-enforced guardrails.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-87988 weaponizes the agentic attack pattern formalized under AAP-001.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

Agentic Security Alert: Host Read/Write Bypass via Whitelist Incoherence

CVSS v4.0: 10.0 Maximum Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-732: Incorrect Permission Assignment for Critical Resource, CWE-22: Path Traversal. Discovered by Esteban Tonglet (HiddenLayer) and publicly disclosed in September 2026. Affects Mistral Vibe (mistral-vibe) prior to version 1.1.0. Exploitation enables indirect prompt injections to perform unrestricted file reads and writes across the entire host file system using auto-approved utilities missing from path control enforcement.

Executive Summary

CVE-2026-87988 is a critical security bypass in Mistral Vibe caused by architectural synchronization discrepancies between two internal permission lists: the auto-approved command whitelist and the path-control enforcement list. During feature development, 31 commands were added to the auto-approval whitelist but were omitted from the path-control enforcement list. Consequently, for these 31 commands, Vibe checked only the executable name and performed no path containment checks on target files.

Furthermore, commands classified as purely “read-only” (such as sort, uniq, csplit, less) included command-line arguments capable of writing arbitrary files (e.g. sort -o /path/to/target). Because sort was auto-approved and exempt from write checks, an attacker could invoke sort -o ~/.bashrc evil_script, silently writing or overwriting critical system files without prompt.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-87988	Discovered by Esteban Tonglet (HiddenLayer)
Common Weakness Enumeration	CWE-732 (Incorrect Permission Assignment), CWE-22 (Path Traversal)	Whitelist desynchronization and unmonitored write flags
Attack Vector	Indirect Prompt Injection (AAP-002) / AAP-003	Malicious GitHub PRs, issues, or repo contents
Vulnerable Component	Policy engine in Mistral Vibe (vibe permission matrix)	31 commands omitted from path control check
Affected Versions	mistral-vibe < 1.1.0	Default auto-approval configuration
Remediated Version	vibe >= 1.1.0	Unified capability-based permission model
Systemic Impact	Unrestricted host read and write access, full remote code execution	Complete control of developer system and secrets

---

2. In-Depth Technical Decomposition & Root Cause

A. The 31 Omitted Whitelist Commands

Mistral Vibe maintained two separate data structures:

1. AUTO_APPROVED_COMMANDS: Tools allowed to execute without user approval.
2. PATH_CHECKED_COMMANDS: Tools whose arguments must be verified as within the current workspace directory.

In versions prior to 1.1.0, 31 commands added to AUTO_APPROVED_COMMANDS were omitted from PATH_CHECKED_COMMANDS. When the permission evaluator encountered one of these 31 commands:

# Vulnerable policy evaluation in Mistral Vibe (pre-1.1.0)
def check_command_allowed(cmd_name, cmd_args, workspace_root):
    if cmd_name in AUTO_APPROVED_COMMANDS:
        # FLAW: Only a subset of commands were subjected to path checks!
        if cmd_name in PATH_CHECKED_COMMANDS:
            return all(is_safe_workspace_path(arg, workspace_root) for arg in cmd_args)
        # If cmd_name is one of the 31 omitted commands:
        return True  # AUTO-APPROVED WITHOUT CHECKING ANY PATH ARGUMENT!
    return False

For any of the 31 omitted commands, an attacker could supply /etc/shadow, /root/.ssh/id_rsa, or any other host path without triggering a security prompt.

B. Read-Only Utilities with Arbitrary Write Flags (sort -o)

A second compounding vulnerability was the assumption that POSIX query and text processing utilities are exclusively read-only. In particular, sort supports the -o (--output) flag:

sort -o /home/target/.bash_profile /tmp/malicious_commands

Vibe evaluated sort as an allowed, safe text utility. Because sort was either omitted from path checks or classified as read-only, the -o argument was treated as a benign argument rather than an arbitrary file write operation.

---

3. Attack Flow & Weaponization Scenarios

sequenceDiagram
    autonumber
    actor Attacker as Attacker / Poisoned Repo
    participant Agent as Mistral Vibe Agent
    participant Policy as Vibe Policy Engine
    participant OS as Host OS Filesystem
    participant Target as Sensitive Target File

    Attacker->>Agent: Prompt injection triggers file modification (AAP-002)
    Agent->>Policy: Command: sort -o /root/.ssh/authorized_keys /tmp/key
    Policy->>Policy: Checks command 'sort' -> Present in AUTO_APPROVED
    Policy->>Policy: Checks if 'sort' in PATH_CHECKED -> Missing!
    Note over Policy: No path inspection performed. AUTO-APPROVED!
    Policy->>OS: Subshell runs: sort -o /root/.ssh/authorized_keys /tmp/key
    OS->>Target: Overwrites authorized_keys with attacker key
    Target-->>Attacker: Attacker connects via SSH with root privileges!

Weaponization Payloads

1. Arbitrary File Overwrite via sort -o:

   sort -o ~/.bashrc /tmp/staged_backdoor

2. System File Exfiltration via Omitted Auto-Approved Tools:

   # Utilizing omitted commands with zero path validation
   comm /etc/shadow /dev/null
   diff /root/.aws/credentials /dev/null

---

4. Detection, Threat Hunting & DFIR Playbooks

A. Sigma Detection Rule

title: Mistral Vibe sort -o Arbitrary File Modification
id: 87988001-vibe-sort-output-overwrite
status: experimental
description: Detects sort utility with -o parameter targeting sensitive files executed under Mistral Vibe.
references:
  - https://blog.marcfredericgomez.fr/six-contournements-de-permissions-sur-mistral-vibe/
author: Hermes Codex Cyber Defense Team
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    CommandLine|contains: 'vibe'
  selection_sort:
    CommandLine|re: 'sort\s+.*-o\s+(~|\/etc|\/root|\/home|\/var)'
  condition: selection_parent and selection_sort
level: critical

---

5. Defense, Hardening & Remediation

1. Apply Official Patch: Upgrade to vibe >= 1.1.0. The codebase replaces dual whitelists with a unified capability-based access model that inspects every argument and output flag.
2. Strict File System Immutability: Mount root directories as read-only and restrict write permissions exclusively to a designated temporary scratch volume.
3. Mandatory User Confirmation for File Modification: Disable auto-approval for any command bearing write flags (-o, --output).
4. Deploy AgentThreat Studio Protections: Employ parameter validation rules from AgentThreat Studio covering AAP-003: Tool Parameter Tampering.

---

6. Related Vulnerabilities & Cross-References

• CVE-2026-87983: Arbitrary File Read via Quoted Absolute Paths
• CVE-2026-87984: Arbitrary File Write via Shell Redirection Target Omission
• CVE-2026-87985: Remote Code Execution via ANSI-C Quoting in find -exec
• CVE-2026-87986: Command Injection via Parser Syntax Error Node Bypass
• CVE-2026-87987: RCE via Environment Variable Assignment Stripping
• AAP-001: Context Boundary Violation
• AAP-002: Indirect Context Injection
• AAP-003: Tool Parameter Tampering