CVE-2026-109429

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4

Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by tree-sitter-bash static parsing. By embedding a command substitution within a single-quoted variable and re-expanding it using the ${var@P} prompt-transform operator, the bash promptvars feature executes the hidden command at runtime. This occurs while only the trailing allowlisted command is classified, leading to silent arbitrary command execution with the privileges of the agent's terminal session.

Recommendations Update Mistral Vibe to version 2.25.4 or later.