mistral.rs CVE-2026-108759

Requires that the mistralrs-code-exec sandboxed code-execution feature is enabled and reachable, and that the attacker can submit or influence shell code within the sandbox (directly or through a prompt-injected agent) - consistent with PR:L, meaning some session/agent access is needed rather than fully anonymous access. The concrete trigger is the ability to name a symlink as an output path or to reuse a session whose input path points to a symlink (the AT:P attack requirement); mistralrs-code-exec then follows the symlink during file read/write operations. Limiting factors: only versions 0.9.0 through 0.9.4 are affected, the code-exec feature must be in use, the attacker must control symlink naming or session reuse, and impact is bounded by the server process's filesystem permissions. Deployments that do not expose the code-execution sandbox to untrusted input are not realistically exploitable.

This is a moderate-priority, context-dependent vulnerability rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H) scores 7.6 (High) and indicates network reachability with low privileges and low complexity, but critically includes AT:P - an attack requirement - reflecting that exploitation depends on the attacker controlling symlink names or reusing sessions with symlinked paths, and on the code-exec sandbox feature being in use. Exploitation status is 'no public exploit identified at time of analysis': the CVE is not on CISA KEV and no proof-of-concept exploit code is flagged in the input, though a detailed technical write-up exists on hackmd and the vendor advisory (VulnCheck) pinpoints the vulnerable source lines, which lowers the bar for a skilled attacker to reproduce it. EPSS and SSVC data were not provided, so probabilistic exploitation likelihood cannot be quantified from this input - treat the likelihood as unknown. The real risk is concentrated in AI-agent deployments where untrusted or prompt-injected content can reach the code-execution sandbox; in those settings the sandbox escape is genuinely serious (host file read/overwrite with server-process permissions), but for deployments that do not expose mistralrs-code-exec to untrusted input the practical risk is low. Net: a legitimately high-impact flaw gated by meaningful preconditions, not a drive-by network exploit.

An attacker interacting with an LLM agent backed by mistral.rs - or injecting malicious instructions via prompt injection - causes sandboxed shell code to create a symlink and name it as an output path (or reuses a session with a symlinked input path). When mistralrs-code-exec follows the symlink, it reads or overwrites files outside the intended sandbox with the server process's permissions, enabling data theft or tampering. No public exploit code is identified, but a detailed technical write-up and the exact vulnerable source lines are publicly referenced.