GHSA-34w8-j94f-8c5w: mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </toolcall> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using mistral.rs before 0.9.5 with the qwen-xml, gemma4, or reasoning output parsers are affected when the model can quote attacker-controlled content. Relevant attacker-controlled sources include documents, web pages, and tool outputs.
What does an attacker need to exploit it?
The attacker needs control over text that the model may quote and must embed parser delimiter strings, such as </tool_call>, in that text. This can cause the affected parser to return additional calls to tools that have already been declared, with attacker-chosen arguments.
What is the remediation?
Upgrade mistral.rs to version 0.9.5 or later. The issue affects versions before 0.9.5.