Skip to content
Submit incident
AII-1001-59307
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Mistral Vibe CLI Shell Expansion Command Execution Vulnerability

A vulnerability in Mistral Vibe CLI reportedly allowed arbitrary OS command execution through unfiltered shell expansion syntax. The issue was discovered on December 15, 2025 and disclosed to the vendor on January 2, 2026.

15 December 2025 · Mistral · Security and cyberattacks
15 December 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1001-59307View source ↗
Quick facts
Category
Security and cyberattacks
Source
mindgard.ai
Date
15 December 2025
Drafted by
Raidu Incident Detection

What happened

Shell expansion was not filtered when running commands in Mistral Vibe CLI, making it possible to run arbitrary OS commands through $() syntax.

Classification

Category
Security and cyberattacks
Industry
IT infrastructure and hosting
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
AI systems
Vibe CLI

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

mindgard.ai
Mindgard Disclosure