CVE-2026-109428 is a high severity permission validation bypass (CVSS 8.8) in Mistral Vibe. A parsing difference between the tool that checks commands and bash lets a command that looks allowlisted run a hidden one. Mistral Vibe 2.25.5 contains the fix, so upgrade to that version or later.
What's affected
The record says Mistral Vibe before 2.25.5 is affected, and the project lists a release tag v2.25.5 in its references. VulnCheck's advisory, which we fetched, says mistral-vibe below 2.25.5 and gives a CVSS 4.0 score of 8.7, against 8.8 under CVSS 3.1 in the record. Both are High.
The weakness is CWE-436, interpretation conflict. The vector is network reachable, low complexity, no privileges, user interaction required, with high confidentiality, integrity and availability impact.
The record explains the mismatch. The function that extracts commands for the permission check, _extract_commands() in bash.py, parses the command text with a tree-sitter bash grammar. Bash, when it runs the text, joins a line that ends in a backslash with the next line. The two disagree on what the command is. The parser can see only a harmless allowlisted prefix such as cd, while bash runs a materially different command, and the permission resolver grants always permission on the basis of what the parser saw.
You are affected if you use Mistral Vibe with command execution allowlists.
How to check if you're exposed
Find the installed version. If you installed with uv or pip:
uv tool list | grep -i mistral
pip show mistral-vibe
Use the one that matches how you installed. Anything below 2.25.5 needs the upgrade.
Then review your permission settings. Look at which commands you have allowed permanently, and whether the allow rules cover commands like cd or echo that are common prefixes in longer chains. An always allowed prefix is the entry point in the record.
If you run the agent on shared machines or in CI, list the hosts and the versions in use.
What to do now
- Upgrade mistral-vibe to 2.25.5 or later.
- Review and shrink your always allow list. Prefer asking for approval on commands that chain or continue across lines.
- Run the agent in a sandbox or container without production credentials and with limited network access.
- Do not point the agent at untrusted repositories or content that could steer it toward crafted commands.
- Keep a log of commands the agent runs and review it for long or multi line command strings.
Why it matters
A permission system that inspects text before it runs has to read the text exactly the way the interpreter will. Shells have many small rules: quoting, escapes, substitutions, continuations. If the checker uses a different grammar, there will be inputs on which the two disagree, and an attacker can aim at that gap.
The record describes the simplest instance. A backslash at the end of a line tells bash to treat the next line as a continuation, but the tree-sitter parser extracted only the first command. The permission check then allowed the whole string.
The lesson reaches every tool that gates shell commands for an AI agent. Text analysis is a weak gate by itself. Stronger controls are sandboxing, least privilege and running commands without a shell where possible. The record does not mark this CVE as known exploited.
Quick check
Which version fixes it?
The record says before 2.25.5 is affected, so upgrade to 2.25.5 or later.
Does an always allow rule make this worse?
Yes. The record says the resolver granted always permission based on the harmless prefix the parser saw.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
