This vulnerability (CWE-732) in Mistral Vibe involves incorrect permission assignment for critical resources. Specifically, certain commands classified as unconditionally allowed lack proper path validation, which permits an attacker to bypass workspace boundaries and access arbitrary files outside the intended workspace environment. This can lead to unauthorized disclosure or manipulation of sensitive files. The vulnerability affects versions 2.15.0 and later. It has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

An attacker can exploit this vulnerability remotely without authentication or user interaction to access arbitrary files outside the active workspace. This can result in unauthorized disclosure, modification, or deletion of sensitive files, severely compromising system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Mistral Vibe versions and monitor for suspicious activity related to workspace command usage. Avoid running untrusted commands classified as unconditionally allowed.