Skip to content
Submit incident
AII-1001-55149
ReportedReported by fewer than three independent publishers, with no official finding.

Mistral Vibe CLI trusts MCP configuration files with arbitrary commands

A vulnerability was discovered in Mistral Vibe CLI where MCP configuration files within workspaces can contain arbitrary commands that execute upon load, reported by Mindgard AI Security.

11 December 2025 · Mistral · Security and cyberattacks
11 December 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1001-55149View source ↗
Quick facts
Category
Security and cyberattacks
Source
mindgard.ai
Date
11 December 2025
Drafted by
Raidu Incident Detection

What happened

Mistral Vibe CLI trusts MCP configuration files within workspaces which can contain arbitrary commands that are executed upon load.

Classification

Category
Security and cyberattacks
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Consequences
None recorded
AI systems
Vibe CLI

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

mindgard.ai
Mindgard Disclosure