Mistral Rs
Monthly
Improper link following in mistral.rs 0.9.0 through 0.9.4 allows code running in the mistralrs-code-exec sandbox to read and overwrite files outside the intended sandbox by using symlinks with the server process's filesystem permissions. The flaw requires the code-execution feature to be enabled and reachable, low-level session or agent access (PR:L), and the ability to name a symlink as an output or reuse a session whose input path is a symlink (AT:P), making it a moderate-priority, context-dependent issue rather than a mass-exploitation threat; no public exploit identified at time of analysis.
Path traversal in the mistral.rs inference server (mistralrs-server-core) through version 0.9.3 lets a remote, unauthenticated attacker direct where the server writes its calibration importance matrix by supplying a non-bare save_cimatrix value to the POST /calibration/apply endpoint. The pre-patch code passed the client-supplied string straight into PathBuf::from with no validation, so values containing '/', '\\', or '../' escape the server's working directory; impact is limited to placing/overwriting the server-generated .cimatrix file at an attacker-chosen path (no attacker-controlled file contents, no direct code execution), assessed as CVSS:3.1 6.9-level moderate risk. Publicly available exploit code exists, the vendor has released a patch in version 0.9.4 (commit 8c81056712709b4845ec6d9531e4d35bab4a367c, PR #2445), and there is no indication of confirmed active exploitation (not in CISA KEV).
Server-side request forgery in EricLBuehler mistral.rs 0.9.3 and earlier allows remote unauthenticated attackers to bypass the private-IP guard used by the server's media-source fetcher, causing the server to request internal addresses such as loopback, link-local, or cloud metadata endpoints. The flaw lives in the is_global_ip/reject_private_ip logic in mistralrs-server-core/src/media_source.rs, which failed to decode IPv6 transition-address forms (IPv4-mapped, IPv4-compatible, 6to4, and NAT64) that embed an internal IPv4 address, so those addresses were judged global and fetched. Publicly available exploit code exists, and the issue is rated CVSS 4.0 6.9 (our independent assessment is a lower-severity SSRF with low confidentiality impact and no integrity or availability impact); no confirmed active exploitation (CISA KEV) was identified at time of analysis. Exploitation is only meaningful where remote media-URL fetching is enabled and reachable internal services exist.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.
Improper link following in mistral.rs 0.9.0 through 0.9.4 allows code running in the mistralrs-code-exec sandbox to read and overwrite files outside the intended sandbox by using symlinks with the server process's filesystem permissions. The flaw requires the code-execution feature to be enabled and reachable, low-level session or agent access (PR:L), and the ability to name a symlink as an output or reuse a session whose input path is a symlink (AT:P), making it a moderate-priority, context-dependent issue rather than a mass-exploitation threat; no public exploit identified at time of analysis.
Path traversal in the mistral.rs inference server (mistralrs-server-core) through version 0.9.3 lets a remote, unauthenticated attacker direct where the server writes its calibration importance matrix by supplying a non-bare save_cimatrix value to the POST /calibration/apply endpoint. The pre-patch code passed the client-supplied string straight into PathBuf::from with no validation, so values containing '/', '\\', or '../' escape the server's working directory; impact is limited to placing/overwriting the server-generated .cimatrix file at an attacker-chosen path (no attacker-controlled file contents, no direct code execution), assessed as CVSS:3.1 6.9-level moderate risk. Publicly available exploit code exists, the vendor has released a patch in version 0.9.4 (commit 8c81056712709b4845ec6d9531e4d35bab4a367c, PR #2445), and there is no indication of confirmed active exploitation (not in CISA KEV).
Server-side request forgery in EricLBuehler mistral.rs 0.9.3 and earlier allows remote unauthenticated attackers to bypass the private-IP guard used by the server's media-source fetcher, causing the server to request internal addresses such as loopback, link-local, or cloud metadata endpoints. The flaw lives in the is_global_ip/reject_private_ip logic in mistralrs-server-core/src/media_source.rs, which failed to decode IPv6 transition-address forms (IPv4-mapped, IPv4-compatible, 6to4, and NAT64) that embed an internal IPv4 address, so those addresses were judged global and fetched. Publicly available exploit code exists, and the issue is rated CVSS 4.0 6.9 (our independent assessment is a lower-severity SSRF with low confidentiality impact and no integrity or availability impact); no confirmed active exploitation (CISA KEV) was identified at time of analysis. Exploitation is only meaningful where remote media-URL fetching is enabled and reachable internal services exist.
Out-of-bounds read in mistral.rs versions 0.8.0 through 0.8.22 allows a remote attacker to crash the GGUF tokenizer by supplying a malformed model file containing out-of-range special token ID values. The `convert_gguf_to_hf_tokenizer` function in `mistralrs-core/src/gguf/gguf_tokenizer.rs` uses eos_token_id, bos_token_id, and unknown_token_id values from untrusted GGUF file metadata as direct array indices without validating they fall within vocabulary bounds. Publicly available exploit code exists, vendor-released patch version 0.8.23 is confirmed, and no CISA KEV listing is present at time of analysis.