{"id":"CVE-2026-124028","kind":"vulnerability","aliases":["CVE-2026-124028"],"related":[],"title":"mistral.rs: delimiter injection lets attackers forge tool calls before 0.9.5","description":"mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.","summary":"Before version 0.9.5, mistral.rs's mistralrs-core treats delimiter strings such as </tool_call> in model-quoted text as real tool-call markers. An attacker who controls documents, web pages or tool outputs can make the qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","mistral.rs","rust","tool-calling"],"not_affected_if":["no-tool-calling","trusted-input-only"],"how_to_check":"- Check the installed mistralrs or mistralrs-core version; anything below `0.9.5` is in range.\n- Look for use of the qwen-xml, gemma4 or reasoning parsers in your serving config.\n- Confirm whether the model reads untrusted documents, web pages or tool outputs.","fix":"- mistral.rs: upgrade to `0.9.5` or later.","status":"open","published_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:25+00:00","updated_at":"2026-11-06T20:44:25+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T20:44:25Z","model":"claude-haiku-5-5","output":{"fix":"- mistral.rs: upgrade to `0.9.5` or later.","reach":"unknown","title":"mistral.rs: delimiter injection lets attackers forge tool calls before 0.9.5","impact":"medium","summary":"Before version 0.9.5, mistral.rs's mistralrs-core treats delimiter strings such as </tool_call> in model-quoted text as real tool-call markers. An attacker who controls documents, web pages or tool outputs can make the qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mistral.rs","llm-serving","tool-calling","rust"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker forces unwanted calls to declared tools with chosen arguments","analyst_note":"","how_to_check":"- Check the installed mistralrs or mistralrs-core version; anything below `0.9.5` is in range.\n- Look for use of the qwen-xml, gemma4 or reasoning parsers in your serving config.\n- Confirm whether the model reads untrusted documents, web pages or tool outputs.","plain_action":"","needs_analyst":false,"not_affected_if":["no-tool-calling","trusted-input-only"],"who_is_affected":"Teams that run mistral.rs with tool calling enabled and feed the model content from documents, web pages or tool outputs that they do not fully control. Deployments that only handle trusted prompts, or that do not declare tools, are less exposed. The sources do not describe a specific default configuration.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4339,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124028':13A,16A '-2026':12A,15A '0.9.5':10A,30B,85C 'ai':18B 'ai-tool':17B 'allow':96C 'argument':82B,142C 'attack':5A,53B,80B,97C,111C,140C 'attacker-chosen':79B,139C 'call':8A,27B,50B,74B,101C,134C 'chosen':81B,141C 'contain':86C 'control':55B,112C 'core':35B,94C 'cve':11A,14A 'declar':76B,136C 'delimit':2A,37B,88C,104C 'document':56B,113C 'emb':120C 'extra':73B,133C 'forg':6A 'gemma4':68B,128C 'inject':3A,89C,99C 'let':4A 'like':122C 'llm':21B 'llm-serv':20B 'make':63B,124C 'marker':51B 'mistral.rs':1A,23B,31B,83C 'mistralr':34B,93C 'mistralrs-cor':33B,92C 'model':43B,109C 'model-quot':42B 'output':61B,118C 'page':58B,115C 'parser':71B,131C 'place':103C 'quot':44B,110C 'qwen':66B,126C 'qwen-xml':65B,125C 'real':47B 'reason':70B,130C 'return':72B,132C 'rust':24B 'serv':22B 'string':38B,105C 'tag':121C 'text':45B,107C 'tool':7A,19B,26B,49B,60B,77B,100C,117C,137C 'tool-cal':25B,48B 'treat':36B 'version':29B 'vulner':90C 'web':57B,114C 'xml':67B,127C","nicknames":[],"mitigations":[],"who_affected":"Teams that run mistral.rs with tool calling enabled and feed the model content from documents, web pages or tool outputs that they do not fully control. Deployments that only handle trusted prompts, or that do not declare tools, are less exposed. The sources do not describe a specific default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","llmserving","medium","mistralrs","rust","toolcalling"],"campaign_type":null,"search_a":"'-124028':13A,16A '-2026':12A,15A '0.9.5':10A 'attack':5A 'call':8A 'cve':11A,14A 'delimit':2A 'forg':6A 'inject':3A 'let':4A 'mistral.rs':1A 'tool':7A","search_b":"'0.9.5':30B 'ai':18B 'ai-tool':17B 'argument':82B 'attack':53B,80B 'attacker-chosen':79B 'call':27B,50B,74B 'chosen':81B 'control':55B 'core':35B 'declar':76B 'delimit':37B 'document':56B 'extra':73B 'gemma4':68B 'llm':21B 'llm-serv':20B 'make':63B 'marker':51B 'mistral.rs':23B,31B 'mistralr':34B 'mistralrs-cor':33B 'model':43B 'model-quot':42B 'output':61B 'page':58B 'parser':71B 'quot':44B 'qwen':66B 'qwen-xml':65B 'real':47B 'reason':70B 'return':72B 'rust':24B 'serv':22B 'string':38B 'text':45B 'tool':19B,26B,49B,60B,77B 'tool-cal':25B,48B 'treat':36B 'version':29B 'web':57B 'xml':67B","search_c":"'0.9.5':85C 'allow':96C 'argument':142C 'attack':97C,111C,140C 'attacker-chosen':139C 'call':101C,134C 'chosen':141C 'contain':86C 'control':112C 'core':94C 'declar':136C 'delimit':88C,104C 'document':113C 'emb':120C 'extra':133C 'gemma4':128C 'inject':89C,99C 'like':122C 'make':124C 'mistral.rs':83C 'mistralr':93C 'mistralrs-cor':92C 'model':109C 'output':118C 'page':115C 'parser':131C 'place':103C 'quot':110C 'qwen':126C 'qwen-xml':125C 'reason':130C 'return':132C 'string':105C 'tag':121C 'text':107C 'tool':100C,117C,137C 'vulner':90C 'web':114C 'xml':127C","first_public_at":"2026-10-18T17:35:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124028","severity":null,"published_at":"2026-11-06T20:17:21+00:00","modified_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89777,"url":"https://github.com/EricLBuehler/mistral.rs/commit/b43d3443e946752c0f662c2df42a2974410c9532","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89778,"url":"https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89779,"url":"https://github.com/EricLBuehler/mistral.rs/security/advisories/GHSA-34w8-j94f-8c5w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-18T17:35:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":89780,"url":"https://www.vulncheck.com/advisories/mistral-rs-before-0.9.5-tool-call-injection-via-mistralrs-core-output-parsers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}