A critical arbitrary file write vulnerability in Mistral Vibe allows unauthenticated attackers to overwrite sensitive system files.

The vulnerability stems from improper path validation during shell redirection. Because the application fails to restrict redirection destinations to the active workspace, an attacker can use allowlisted commands to write data to arbitrary paths on the file system.

With a CVSS score of 9.3, this flaw poses a severe risk to system integrity. An attacker could overwrite configuration files, system binaries, or sensitive credentials, leading to full system compromise or permanent denial of service.

Immediate Action: Update to the latest version of Mistral Vibe as soon as a security update is released by the vendor.

Proactive Monitoring: Monitor file system integrity, particularly in system-critical directories, for unexpected write operations or file modifications.

Compensating Controls: Run the Mistral Vibe process with the lowest possible system privileges to limit the scope of unauthorized file writes.

Public Exploit Available: No

Given the potential for arbitrary file writes and system-wide impact, this vulnerability requires urgent attention. Administrators should track the vendor's security updates and apply patches immediately upon release to prevent unauthorized modification of the host system.