Mistral Vibe: a prompt-transform operator smuggled commands past approval

01What happened

VulnCheck published CVE-2026-109429 on October 13, 2026, a command permission gate bypass in the Mistral Vibe coding agent, and credits Minqiang Gui. The fix is version 2.25.4, which Mistral released on September 12, 2026, a month before the CVE became public. Mistral's own advisory MAI-2026-003 listed six other shell permission CVEs fixed in that same release, and none of them is this one.

02How it works

The flaw is an interpretation conflict between the checker and the shell, classified as CWE-436. Mistral Vibe classifies a command line using tree-sitter-bash static parsing, which does not see a command substitution hidden inside a single-quoted variable value. The line then re-expands that variable with bash's ${var@P} prompt-transform operator, and bash's promptvars feature runs the hidden command. Only the trailing allowlisted command reaches the classifier, so the hidden one runs silently with the privileges of the agent's terminal session.

03Who is affected

Every Mistral Vibe release before 2.25.4 carries the bypass, per VulnCheck. Because the patch shipped a month before disclosure, installs that have updated since September 12, 2026 are not exposed, while pinned or vendored older builds still are.

04What to do

Update Mistral Vibe to 2.25.4 or later, and check any pinned or vendored copy separately, because the fixed release predates the CVE by a month. Treat a shell allowlist that is matched by static parsing as a weak boundary for an agent that reads untrusted content.

Questions people ask

Which Mistral Vibe version fixes CVE-2026-109429?

Mistral Vibe 2.25.4 fixes CVE-2026-109429, and VulnCheck lists every release before it as affected. That release shipped on September 12, 2026, roughly a month before the CVE was published, and its changelog records shell permission checks that now require approval for risky syntax. Anyone still running an older pinned build remains exposed.

Is CVE-2026-109429 the same as the six Mistral Vibe shell flaws from September?

No. Mistral's advisory MAI-2026-003, published September 14, 2026, covers CVE-2026-87983 through CVE-2026-87988, six shell permission flaws whose advisories Mistral attributes to HiddenLayer. None of them mentions the ${var@P} prompt-transform operator or tree-sitter-bash parsing. CVE-2026-109429 is a separate bypass, credited to Minqiang Gui and published by VulnCheck on October 13, 2026.

How do I tell whether my Mistral Vibe install blocks the ${var@P} bypass?

Check the installed Mistral Vibe version against 2.25.4, which VulnCheck names as the fixed release. Pull request 1084 in the mistralai/mistral-vibe repository merged that release on September 12, 2026 and records shell permission security fixes in its changelog. The advisory gives no proof-of-concept command and no detection signature, so a version check is the practical test.

Sources 5 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2github.comGitHub Advisory
3. 3docs.mistral.aiMistral Advisory
4. 4github.comRelease Notes
5. 5github.comPatch Pull Request