{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:53:56.024113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T14:57:01.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mistral-vibe",
          "repo": "https://github.com/mistralai/mistral-vibe",
          "vendor": "mistralai",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "affected",
              "version": "1.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it\u0027s parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user\u0027s system without approval."
            }
          ],
          "value": "An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it\u0027s parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user\u0027s system without approval."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-43",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-43 Exploiting Multiple Input Interpretation Layers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-228",
              "description": "CWE-228: Improper Handling of Syntactically Invalid Structure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T14:31:20.859Z",
        "orgId": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
        "shortName": "HiddenLayer"
      },
      "references": [
        {
          "url": "https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
    "assignerShortName": "HiddenLayer",
    "cveId": "CVE-2026-87986",
    "datePublished": "2026-09-11T14:31:20.859Z",
    "dateReserved": "2026-09-09T19:14:18.451Z",
    "dateUpdated": "2026-09-11T14:57:01.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-87986\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-11T14:53:56.024113Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-11T14:55:02.207Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-43\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-43 Exploiting Multiple Input Interpretation Layers\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 10, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/mistralai/mistral-vibe\", \"vendor\": \"mistralai\", \"product\": \"mistral-vibe\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.3.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it\u0027s parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user\u0027s system without approval.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it\u0027s parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user\u0027s system without approval.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-228\", \"description\": \"CWE-228: Improper Handling of Syntactically Invalid Structure\"}]}], \"providerMetadata\": {\"orgId\": \"6f8de1f0-f67e-45a6-b68f-98777fdb759c\", \"shortName\": \"HiddenLayer\", \"dateUpdated\": \"2026-09-11T14:31:20.859Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-87986\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-11T14:57:01.512Z\", \"dateReserved\": \"2026-09-09T19:14:18.451Z\", \"assignerOrgId\": \"6f8de1f0-f67e-45a6-b68f-98777fdb759c\", \"datePublished\": \"2026-09-11T14:31:20.859Z\", \"assignerShortName\": \"HiddenLayer\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}