elixir-mint Mint EUVD-2026-33938

Exploitation requires that the target application passes attacker-controlled input directly as the method argument to Mint.HTTP.request/5 without prior sanitization - for example, an HTTP proxy, API gateway, or forwarding service that accepts an arbitrary HTTP method from an external caller and relays it downstream via Mint. The method-based injection vector is present under the default Mint configuration on all versions 0.1.0 through 1.8.x. The target/path injection vector additionally requires the application to opt out of target validation by setting skip_target_validation: true (non-default since Mint 1.7.0); absent that opt-out, the path vector is already mitigated. Exploitation is limited by the AV:L CVSS vector, meaning the attacker must have application-level input influence rather than direct network access to Mint itself, and AT:P confirms that the specific forwarding/proxy deployment pattern must be present. Applications that use a fixed, hardcoded HTTP method (the common case) are not exposed.

The CVSS 4.0 base score of 2.1 reflects a genuinely low-severity finding for the majority of Mint deployments. The vector AV:L (Local) indicates that the attacker cannot exploit this remotely against the library itself - they must be in a position to inject input into an application that passes those values unsanitized to Mint.HTTP.request/5, which is an application-design precondition rather than a network-reachable surface. AT:P (Attack Requirements: Present) confirms specific deployment conditions must exist: the application must act as a proxy or pass user-controlled HTTP method values without prior sanitization. Impact is limited to low integrity effects on both the vulnerable and subsequent systems (VI:L, SI:L) with no confidentiality or availability impact, consistent with the nature of request smuggling (injecting unauthorized requests rather than exfiltrating data or crashing services). No EPSS score was provided in the intelligence data; the vulnerability is not in the CISA KEV catalog, and no public exploit has been identified. IMPORTANT DISCREPANCY: The intelligence metadata includes a 'Tags: RCE' label that is directly contradicted by the CVE description (CRLF injection / request smuggling), the CWE assignment (CWE-93), and the CVSS impact subscores (no code execution indicators); this tag should be treated as erroneous and not relied upon for triage decisions.

An attacker using an application that proxies or relays user-supplied HTTP method values through Mint could supply a crafted method string such as 'GET / HTTP/1.1\r\nX-Injected: evil\r\nGET /admin' - exactly the pattern tested in the patch's new test suite. Mint's encode_request_line/2 in versions before 1.9.0 would splice this directly into the wire-format request line, causing the upstream server to parse the injected content as a second pipelined request on the shared TCP connection. No public proof-of-concept code has been identified; the attack complexity is low once a vulnerable application surface is identified.