Tool Call Injection via Delimiter Strings in mistral.rs Output Parsers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
mistral.rs before 0.9.5 contains a delimiter injection flaw in mistralrs-core, classified as CWE-140. Attackers who control documents, web pages or tool outputs can embed closing tags such as </tool_call> in text that the model quotes, causing the qwen-xml, gemma4 or reasoning parsers to return extra calls to declared tools with attacker-chosen arguments. The CVSS 4.0 base score is 2.3 (LOW), reflecting a network attacker, high attack complexity, user interaction, and low confidentiality and integrity impact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EricLBuehler | mistral.rs | before 0.9.5 | 0.9.5 | Patch available | CNA |
- mistral.rs VendorEricLBuehler Affected before 0.9.5 Fixed in 0.9.5 Patch available CNA
Remediation
Upgrade EricLBuehler mistral.rs to version 0.9.5 or later, which fixes the flaw. The sources list no vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA mistral.rs (EricLBuehler) Fixed in 0.9.5
Timeline
- 2026-11-06 Threatist record created from CVE-2026-124028
- 2026-11-06 Alias added: GHSA-g3jq-5q72-jc6f
References
More EricLBuehler vulnerabilities
- TI-2026-71457 Path traversal in EricLBuehler Mistral.rs calibration_apply CVSS 4.0MEDIUM 6.9
- TI-2026-52758 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds CVSS 4.0MEDIUM 5.3
- TI-2026-71456 Server-side request forgery in mistral.rs is_global_ip check CVSS 4.0MEDIUM 6.9
- TI-2026-70737 Symlink following in mistral.rs code execution sandbox lets attackers escape CVSS 4.0HIGH 7.6
Sources
- CVE-2026-124028 · CVE Program
- CVE-2026-124028 · NVD
- FIRST EPSS
- GHSA-g3jq-5q72-jc6f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences