This vulnerability (CWE-22) in Mistral Vibe (>=1.3.4) permits an attacker to perform arbitrary file writes outside the active workspace. The root cause is the omission of shell redirection destinations from permission checks, which allows otherwise permitted commands to write files to arbitrary locations accessible by the process. This can lead to unauthorized file creation or overwriting without user approval. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in unauthorized file creation or overwriting outside the restricted workspace, potentially compromising system integrity and confidentiality. Since the vulnerability allows arbitrary file writes without user approval and requires no privileges or user interaction, it poses a critical risk to affected systems.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Mistral Vibe process and monitor for suspicious activity related to file writes outside expected directories.