This vulnerability in Mistral Vibe (>=2.6.0) involves improper limitation of a pathname to a restricted directory (CWE-22). Attackers can leverage quoted absolute paths in allowlisted shell commands to bypass workspace restrictions and read files outside the active workspace without user approval. The root cause is inadequate handling of quotation marks during path validation, enabling arbitrary file read access.

An attacker can read arbitrary files outside the restricted workspace directory without authentication or user interaction, potentially exposing sensitive information. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, low attack complexity, and no privileges or user interaction required.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected versions and monitor for suspicious activity related to path traversal attempts.