{"schema":"threatline.record/2","record":{"id":"CVE-2026-109428","aliases":[],"summary":"Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation","details":"Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.","categories":["Unclassified"],"product":"mistral-vibe","vendor":"mistralai","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109428","source_modified_at":"2026-10-13T18:24:09.736Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"mistral-vibe","vendor":"mistralai","versions":[{"status":"affected","version":"0","versionType":"semver","lessThan":"2.25.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109428","source_modified_at":"2026-10-13T18:24:09.736Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"mistral-vibe","ecosystem":null},"version":"2.25.5","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00509,"percentile":0.42601,"score_date":"2026-10-23"},"published_at":"2026-10-13T18:17:05.062Z","modified_at":"2026-10-13T18:24:09.736Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109428","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T18:24:09.736Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109428","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/releases/tag/v2.25.5","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/pull/1111","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/mistralai/mistral-vibe/commit/c069ffa1e12fb5f2487b489217c40ab97721d553","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/mistral-vibe-permission-bypass-via-bash-line-continuation","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T18:24:09.736Z","content_hash":"165c0d277cb22a8aeca00dd516465ed540c4de6790a629b8ac76deaa930d98f7"}}