CVE-2026-87983

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions 2.6.0 through 2.25.3

Description An arbitrary file read issue exists where an attacker can bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. This occurs due to improper handling of quotation marks during path validation, which allows files located outside the active workspace to be read without user approval. This flaw is part of a set of permission check issues that could allow reading or writing outside the workspace or executing code as the Vibe user.

Recommendations Update to version 2.25.4. Ensure that permission prompts remain enabled, as auto-approval modes intentionally bypass these controls.