_READ_ONLY_COMMANDS_POSIX expansion adds 31 commands with no path checking, granting unconditional access to the full host filesystem

CVE Number

CVE-2026-87988

‍

Summary

Mistral Vibe automatically approves a large set of commands classified as read only even though most of them are not subject to the workspace path restrictions used elsewhere for file access. An attacker can use these commands to read files anywhere on the host without user approval, potentially exposing credentials, SSH keys, API tokens, configuration files, source code, and other sensitive data, while some affected commands can also write to arbitrary locations.

‍

Products Impacted

This vulnerability was introduced in mistral-vibe v2.15.0.

‍

CVSS Score: 10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

‍

CWE Categorization

CWE-732: Incorrect Permission Assignment for Critical Resource

‍

Details

Vibe's read only command allowlist grew in v2.15.0 without a corresponding expansion of the commands covered by workspace path validation. This leaves most of the newly allowlisted utilities free to access absolute paths elsewhere on the host even though Vibe is intended to ask before crossing the active workspace boundary.

_collect_outside_dirs() only inspects path arguments when the command appears in _PATH_COMMANDS.

if not command or command not in _PATH_COMMANDS:
    continue

Of the 37 entries added to _READ_ONLY_COMMANDS_POSIX, only cat, head, ls, stat, tail, and wc were also present in _PATH_COMMANDS. The remaining 31 commands can receive paths outside the workspace without those paths ever reaching the boundary check.

There is no quoting trick or unusual shell syntax involved. Commands such as grep, diff, du, find, sort, uniq, less, od, md5sum, sha1sum, sha256sum, shasum, comm, join, paste, and tac can simply be given a normal absolute path. Because _collect_outside_dirs() skips them, outside_dirs remains empty and the allowlisted command can run without asking the user.

A normal sort invocation is enough to demonstrate arbitrary reading outside the workspace:

Some of the commands placed in the read only set can also write files. sort supports an output path through -o, uniq accepts an output file as its second positional argument, and less can save viewed content when used with an output option. The same gap in path validation therefore permits writes as well as reads.

Classifying a utility as read only does not make access to arbitrary filesystem paths safe, and in this case the classification is not even sufficient to guarantee that the utility cannot create files. Workspace validation should cover every automatically approved command that accepts path arguments so that access outside the repository depends on the destination being requested, not on which allowlist happened to contain the command.

‍

Project URL:

https://mistral.ai/fr/products/vibe/

https://github.com/mistralai/mistral-vibe

‍

RESEARCHER: Esteban Tonglet, Security Researcher, HiddenLayer