CVE-2026-87984 mistralai CVE debrief

Who should care

Defenders responsible for systems and deployments using Mistral Vibe version 1.3.4 or later should assess potential exposure and impact, and prioritize verification and mitigation efforts.

Why it matters

A critical vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval, posing significant risks to systems and deployments using this version.

• Verify exposure and assess potential impact on systems and deployments using Mistral Vibe version 1.3.4 or later.
• Implement compensating controls to mitigate potential damage from arbitrary file writes.
• Monitor for suspicious activity and exception tracking to detect potential exploitation attempts.
• Review and update incident response plans to address potential consequences of exploitation.

Technical summary

The CVE record describes an arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4. The vulnerability allows an attacker to create or overwrite files outside the active workspace without user approval, due to omitted shell redirection destinations from permission checks. This vulnerability has a CVSS score of 9.3 and is considered critical. The vulnerability affects Mistral Vibe version 1.3.4 or later, and defenders should prioritize verifying exposure and assessing potential impact. The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems and deployments using Mistral Vibe version 1.3.4 or later.

Recommended defensive actions

• Verify exposure by checking Mistral Vibe versions in use and assessing potential impact on systems and deployments.
• Implement compensating controls, such as restricting file write permissions, to mitigate potential damage.
• Monitor for suspicious activity and exception tracking to detect potential exploitation attempts.
• Review and update incident response plans to address potential consequences of exploitation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific exploitation or impact details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.