This vulnerability (CWE-228) in Mistral Vibe versions 1.3.4 and later enables attackers to execute arbitrary code by exploiting the parser's inability to interpret certain shell constructs. The parser skips unparsed segments, which attackers leverage to embed commands that evade permission checks, resulting in unauthorized command execution on the affected system. The CVSS 4.0 base score is 10.0, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to execute arbitrary commands on the victim's system without any privileges or user interaction, leading to full compromise of confidentiality, integrity, and availability of the affected system.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should apply strict network controls to limit exposure and monitor for suspicious activity related to command execution attempts.