This vulnerability (CWE-184) in Mistral Vibe involves an incomplete list of disallowed inputs, specifically ANSI-C quoted arguments, which are not properly inspected during command permission checks. This allows an attacker to bypass these checks and execute arbitrary code on the affected system by crafting allowlisted commands containing such arguments. The vulnerability affects versions >=2.9.0 and has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Successful exploitation results in arbitrary code execution on the user's system without any required privileges or user interaction, leading to full compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with allowlisted commands and avoid processing ANSI-C quoted arguments that could bypass permission checks.