OPENSUSE-SU-2026:11778-1
Vulnerability from csaf_opensuse - Published: 2026-09-14 00:00 - Updated: 2026-09-15 07:43Summary
mistral-vibe-2.25.4-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: mistral-vibe-2.25.4-1.1 on GA media
Description of the patch: These are all security issues fixed in the mistral-vibe-2.25.4-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11778
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
not set
Affected products
Recommended
4 products, the same list as for
CVE-2026-87984
Threats
Impact
not set
References
6 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "mistral-vibe-2.25.4-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the mistral-vibe-2.25.4-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11778",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11778-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87984 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87984/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87987 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87987/"
}
],
"title": "mistral-vibe-2.25.4-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-15T07:43:46Z",
"generator": {
"date": "2026-09-14T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11778-1",
"initial_release_date": "2026-09-14T00:00:00Z",
"revision_history": [
{
"date": "2026-09-14T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T07:43:46Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mistral-vibe-2.25.4-1.1.aarch64",
"product": {
"name": "mistral-vibe-2.25.4-1.1.aarch64",
"product_id": "mistral-vibe-2.25.4-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mistral-vibe-2.25.4-1.1.ppc64le",
"product": {
"name": "mistral-vibe-2.25.4-1.1.ppc64le",
"product_id": "mistral-vibe-2.25.4-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mistral-vibe-2.25.4-1.1.s390x",
"product": {
"name": "mistral-vibe-2.25.4-1.1.s390x",
"product_id": "mistral-vibe-2.25.4-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mistral-vibe-2.25.4-1.1.x86_64",
"product": {
"name": "mistral-vibe-2.25.4-1.1.x86_64",
"product_id": "mistral-vibe-2.25.4-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mistral-vibe-2.25.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64"
},
"product_reference": "mistral-vibe-2.25.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mistral-vibe-2.25.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le"
},
"product_reference": "mistral-vibe-2.25.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mistral-vibe-2.25.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x"
},
"product_reference": "mistral-vibe-2.25.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mistral-vibe-2.25.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64"
},
"product_reference": "mistral-vibe-2.25.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-87984",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87984"
}
],
"notes": [
{
"category": "general",
"text": "An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87984",
"url": "https://www.suse.com/security/cve/CVE-2026-87984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T00:00:00Z",
"details": "not set"
}
],
"title": "CVE-2026-87984"
},
{
"cve": "CVE-2026-87987",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87987"
}
],
"notes": [
{
"category": "general",
"text": "An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87987",
"url": "https://www.suse.com/security/cve/CVE-2026-87987"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.aarch64",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.ppc64le",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.s390x",
"openSUSE Tumbleweed:mistral-vibe-2.25.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-14T00:00:00Z",
"details": "not set"
}
],
"title": "CVE-2026-87987"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…