CVE-2026-124028 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Before version 0.9.5, mistral.rs's mistralrs-core treats delimiter strings such as </tool_call> in model-quoted text as real tool-call markers. An attacker who controls documents, web pages or tool outputs can make the qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
first public Oct 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run mistral.rs with tool calling enabled and feed the model content from documents, web pages or tool outputs that they do not fully control. Deployments that only handle trusted prompts, or that do not declare tools, are less exposed. The sources do not describe a specific default configuration.
Not affected if no-tool-calling, trusted-input-only
Who cares llm-serving, mistral.rs, rust, tool-calling
0.9.5 is in range.0.9.5 or later.mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.