What’s Vulnerable › Vulnerabilities

CVE-2026-87987

• Severity: critical (CVSS 10.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-11
• Weakness: CWE-15

Description

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.

Affected products

• mistralai mistral-vibe: from 2.6.0

References

• https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5

Get alerted when CVE-2026-87987 or the next vulnerability affects your stack