What is GHSA-wcxh-p9m4-jq8r?

GHSA-wcxh-p9m4-jq8r is a security advisory published by GitHub Security Advisories with Critical severity. An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an...

Which CVE IDs does GHSA-wcxh-p9m4-jq8r cover?

GHSA-wcxh-p9m4-jq8r covers the following CVE IDs: CVE-2026-87983. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-wcxh-p9m4-jq8rCritical

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-87983 →

📋 Description

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87983
https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe
https://github.com/advisories/GHSA-wcxh-p9m4-jq8r