CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{k}="#{v}" with no validation of CR (\r), LF (\n), or double-quote characters. The values come verbatim from the caller via Tesla.Multipart.add_field/4 (the name parameter), Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4 (both the filename parameter and other disposition opts). A " in the value closes the quoted parameter early; a \r\n ends the Content-Disposition header line and starts a new part header (such as a forged Content-Type), or, after a second \r\n, ends the entire part header block and prepends bytes to the part body. The default-filename path in add_file/3 derives the filename via Path.basename/1, which does not strip CR or LF, so any application forwarding a partially-attacker-controlled file path inherits the same issue. This issue affects tesla: from 0.8.0 before 1.18.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elixir-tesla | tesla | 0.8.0 to before 1.18.3 | 1.18.3 | Patch available | CNA |
| — | tesla (Hex) | 0.8.0 to before 1.18.3 | 1.18.3 | Patch available | GHSA-28jh-g32x-v9v4 |
- tesla Vendorelixir-tesla Affected 0.8.0 to before 1.18.3 Fixed in 1.18.3 Patch available CNA
- tesla (Hex) Vendor— Affected 0.8.0 to before 1.18.3 Fixed in 1.18.3 Patch available GHSA-28jh-g32x-v9v4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:* | 0.8.0 to before 1.18.3 | Vulnerable | elixir-tesla |
- cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:* Versions 0.8.0 to before 1.18.3 Vulnerable ·elixir-tesla
Remediation
- Fix · CNA tesla (elixir-tesla) Fixed in 1.18.3
- Fix · GHSA-28jh-g32x-v9v4 tesla (Hex) Fixed in 1.18.3 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
elixir-tesla tesla 1.18.3
5 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-35953 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.MintPriority HIGH 69
- TI-2026-35951 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsPriority HIGH 69
- TI-2026-35952 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48598
- 2026-10-03 Alias added: GHSA-28jh-g32x-v9v4
References
Advisory 4
More elixir-tesla Tesla vulnerabilities
- TI-2026-35953 Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint CVSS 4.0HIGH 8.2
- TI-2026-35951 Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects CVSS 4.0HIGH 8.2
- TI-2026-35952 CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection CVSS 4.0LOW 2.1
- TI-2026-35950 Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression CVSS 4.0HIGH 8.2
Sources
- CVE-2026-48598 · CVE Program
- CVE-2026-48598 · NVD
- FIRST EPSS
- GHSA-28jh-g32x-v9v4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences