CVE-2026-109428

Summary

A permission validation bypass in Mistral Vibe allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash when handling backslash-newline line continuations. This vulnerability enables attackers to craft command strings that appear safe but actually execute hidden malicious commands.

Exploitability

Moderately difficult to exploit as it requires crafting specific command strings with backslash-newline continuations that leverage the parsing discrepancy, but can be achieved with knowledge of the affected code structure and minimal preconditions.

Blast radius

The vulnerability could allow attackers to execute arbitrary commands on the system with the privileges of the affected service, potentially leading to full system compromise or data exfiltration across multiple systems using Mistral Vibe.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.25.5 or later to fix the permission validation bypass vulnerability in Mistral Vibe.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.