Shell Permission Bypass via Environment Assignments

Mistral Vibe versions 2.6.0 through 2.25.3 omit environment assignments from shell permission checks while retaining them during execution. A command classified as safe can therefore execute an attacker-selected program without the expected approval prompt, with the permissions of the Vibe process. Repository-based exploitation requires Vibe to process attacker-controlled content and the model to emit a crafted shell tool call. SecMate independently reported this behavior to Mistral on September 5, 2026, before HiddenLayer published the overlapping CVE advisory on September 11. Version 2.25.4 fixes the issue.