What happened
Published 2026-10-13 (CVSS 8.8 v3.1, CWE-436) by VulnCheck. tree-sitter-bash static parsing cannot detect a substitution hidden in a single-quoted value, and bash's promptvars feature executes it at runtime; only the trailing allowlisted command is classified. Verified via NVD REST API.
Why it matters
Same agent-execution class as the Roo Code cluster: a frontier-lab-shipped agent CLI's permission gate is defeated by shell metacharacter semantics invisible to its parser, giving a prompt-injected command silent code execution with the developer's session privileges. Shows the bash-permission-bypass class now spans multiple major agent tools.
Attack vector
Indirect prompt injection supplies input such as a single-quoted variable whose value contains a command substitution, re-expanded at runtime with the ${var@P} prompt-transform operator. The permission gate only sees the allowlisted trailing command, so the agent silently executes the hidden command in the terminal session.
Affected systems
Mistral AI mistral-vibe < 2.25.4 (AI agent CLI)
Mitigation
Upgrade mistral-vibe to 2.25.4 (fix commit 19b5b74). Until patched, disable auto-approval of shell commands and run against trusted inputs only.