Mistral Vibe's Command Allowlist Ignores Environment Variable Prefixes, So `git diff` Runs Attacker Code (CVE-2026-87987)

Mistral Vibe, Mistral AI's command-line coding agent, version 2.6.0 and later

HiddenLayer published advisories on September 11, 2026. Environment variable assignments written before a command were stripped from the representation Vibe used for permission checks but still passed to the program, so an allowlisted command such as `git diff` prefixed with `GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=diff.external GIT_CONFIG_VALUE_0=...` ran an attacker-chosen program with no approval prompt (CVE-2026-87987, CVSS 4.0 10.0). A companion flaw introduced in 1.3.4 omitted shell redirection targets from permission checks, letting allowlisted commands create or overwrite files outside the workspace (CVE-2026-87984, CVSS 4.0 9.3). Found by Esteban Tonglet of HiddenLayer

The approval layer parsed a simplified version of the command line, not the one the shell executes, so whatever the parser dropped ran unchecked