TI-2026-71457 CVE-2026-108940 · GHSA-frch-8x47-3j8r
Path traversal in EricLBuehler Mistral.rs calibration_apply
Priority HIGH 70
A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3.
EricLBuehler
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
EricLBuehler records in CISA KEVNo EricLBuehler vulnerabilities are listed in CISA KEV.
Records
5 records
TI-2026-52758 CVE-2026-75090 · GHSA-9x3x-hjpw-2q3f
EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds
Priority MEDIUM 63
A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22.
TI-2026-71456 CVE-2026-108939 · GHSA-qjg5-pf8f-r356
Server-side request forgery in mistral.rs is_global_ip check
Priority LOW 37
A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3.
TI-2026-70737 CVE-2026-108759 · GHSA-fjjm-5mgr-r8vp
Symlink following in mistral.rs code execution sandbox lets attackers escape
Priority LOW 35
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks.
TI-2026-86088 CVE-2026-124028 · GHSA-g3jq-5q72-jc6f
Tool Call Injection via Delimiter Strings in mistral.rs Output Parsers
Priority LOW 11
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes.