EUVD-2026-34012
GHSA-28jh-g32x-v9v4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (EEF) · only source for this CVE.
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values.
Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A " in the value closes the quoted parameter early; a \r\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \r\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue.
This issue affects tesla: from 0.8.0 before 1.18.3.
AnalysisAI
Improper sanitization of multipart Content-Disposition parameters in the Tesla HTTP client library allows header injection or body prepending through CRLF or double-quote characters in filenames or field names. Affected versions 0.8.0 to 1.18.2. An attacker who controls a filename or field name passed to multipart API functions can inject arbitrary part headers (e.g., forged Content-Type) or prepend bytes to the part body when processed by a lenient multipart parser. Public exploit code exists, though the EPSS score is low (0.01%) and SSVC assesses exploitation as poc with partial technical impact and not automatable.
Denial-of-service in elixir-tesla Tesla versions 0.6.0 through 1.18.2 allows remote servers to crash or freeze calling E
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Denial of service in the Elixir Tesla HTTP client (versions 1.3.0 through 1.18.2) when using the Tesla.Adapter.Mint adap
Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. Rate
Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC
The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to
Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing.
Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows atta
Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob w
Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today