An attacker can craft a malicious input string designed to deceive the application's permission checker. By using line continuation characters, the tree-sitter-bash library parses the command as a benign, allowlisted prefix (such as 'cd'), while the actual bash shell interprets the full string, including hidden commands appended after the newline. This causes the resolve_permission function to grant unauthorized access, leading to arbitrary command execution on the host. This vulnerability has a CVSS v3.1 base score of 8.8, posing a significant risk to environments where Mistral Vibe processes untrusted user input.

Impact

Successful exploitation allows unauthenticated or unauthorized users to execute arbitrary commands with the privileges of the Mistral Vibe application. This could lead to full system compromise, data exfiltration, or lateral movement within the network. The vulnerability affects all deployments of Mistral Vibe prior to version 2.25.5.

Recommendation

• Patch Mistral Vibe to version 2.25.5 or later immediately to resolve the parsing logic error in bash.py.
• Audit logs for suspicious bash executions or unusual command line arguments originating from the Mistral Vibe process tree.
• Restrict the permissions of the user account running Mistral Vibe to the minimum necessary level to reduce the impact of potential command injection.
• Review all inputs passed to _extract_commands() for unexpected backslash-newline character sequences that could be used to manipulate bash command interpretation.