CVE-2026-124028

mistral.rs can interpret quoted content as an additional tool call

mistral.rs · mistral.rs model output parser

First documented disclosure · Review checkpoint

Summary

Quoted external content can become an unintended tool call.

Severity and exploitation evidence

Low · 2.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The output parser did not reliably distinguish quoted document text from model-emitted control markers.

Conditions required

The application must use an affected parser and offer tools. Untrusted content must reach model output in the relevant form.

Potential impact

A parser can return an additional tool call with arguments influenced by outside content. Effects depend on application authorization.

Affected versions and configurations

CNA says before 0.9.5. Maintainer table lists before 0.9.3.

Fix and mitigation status

0.9.5.

Practical next steps

Use 0.9.5 or later and authorize tool calls before dispatch.

Operating lesson

Keep model control tokens distinguishable from ordinary document text.

Evidence and limits

The September 25 public fix predates the October maintainer advisory and November CVE. The affected-version descriptions differ, but both name 0.9.5 as a fixed version.

Sources