CVE-2026-108759: mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of mistral.rs versions 0.9.0 through 0.9.4 that use mistralrs-code-exec are exposed when sandboxed shell code can be influenced by an attacker or by a prompt-injected agent. The impact is limited by the permissions of the server process.
What does an attacker need to exploit it?
The attacker needs a way to cause sandboxed shell code to use symlinks. They can name symlinks as output files or reuse sessions whose input paths are symlinked.
What can exploitation allow?
Exploitation can let sandboxed code read and overwrite files outside the sandbox. Files accessible to the server process are the potential targets.