ericlbuehler vulnerabilities

Products

• ericlbuehler/mistral.rs 5

Latest ericlbuehler CVEs

Newest publication first

1. CVE-2026-124028 mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers

   Published 2026-11-06

   Low·CVSS 2.3 EPSS 0.19%

   mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to...

2. CVE-2026-108940 EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal

   Published 2026-10-12

   Medium·CVSS 6.9 EPSS 0.69%

   A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiat...

3. CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

   Published 2026-10-12

   Medium·CVSS 6.9 EPSS 0.48%

   A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The...

4. CVE-2026-108759 mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

   Published 2026-10-11

   High·CVSS 7.6 EPSS 0.32%

   mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with sym...

5. CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

   Published 2026-08-18

   Medium·CVSS 5.3 EPSS 0.69%

   A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eos_token_id/bos_token...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.