From d7902b87b8a142389b31e0ed7cfd2e4fdb75f290 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C6=B3unior=20=C6=A4ortal?=
 <35150859+portyu9@users.noreply.github.com>
Date: Mon, 19 Oct 2026 16:59:18 +0000
Subject: [PATCH] Improve GHSA-m93j-546h-jwjv

---
 .../GHSA-m93j-546h-jwjv.json                  | 31 +++++++++++++++++--
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/advisories/unreviewed/2026/09/GHSA-m93j-546h-jwjv/GHSA-m93j-546h-jwjv.json b/advisories/unreviewed/2026/09/GHSA-m93j-546h-jwjv/GHSA-m93j-546h-jwjv.json
index 8b2ca97fe2a5..7d17d30078c0 100644
--- a/advisories/unreviewed/2026/09/GHSA-m93j-546h-jwjv/GHSA-m93j-546h-jwjv.json
+++ b/advisories/unreviewed/2026/09/GHSA-m93j-546h-jwjv/GHSA-m93j-546h-jwjv.json
@@ -1,24 +1,49 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m93j-546h-jwjv",
-  "modified": "2026-09-11T15:32:42Z",
+  "modified": "2026-09-11T15:32:43Z",
   "published": "2026-09-11T15:32:42Z",
   "aliases": [
     "CVE-2026-87986"
   ],
+  "summary": "Mistral Vibe shell permission bypass via incomplete command parsing allows arbitrary code execution",
   "details": "An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "mistral-vibe"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.3.4"
+            },
+            {
+              "fixed": "2.25.4"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87986"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mistralai/mistral-vibe/blob/v2.25.3/vibe/core/tools/builtins/bash.py?utm_source=chatgpt.com#L50-L76"
+    },
     {
       "type": "WEB",
       "url": "https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe4"