Description
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EricLBuehler | mistral.rs | < 0.9.5 | 0.9.5 |
References
- Patch Commit patch
- https://github.com/EricLBuehler/mistral.rs product
- GitHub Security Advisory (GHSA-34w8-j94f-8c5w) vendor-advisory
- https://github.com/EricLBuehler/mistral.rs/pull/2455 issue-tracking patch
- mistral.rs v0.9.5 Release Notes release-notes
- VulnCheck Advisory: mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers third-party-advisory