Description
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
EricLBuehler mistral.rs
Default version status: unaffected
0.9.0 to ≤ 0.9.4affected
pkg:github/EricLBuehler/mistral.rsReferences
- https://hackmd.io/@haind03/ericlbuehler-mistralrs-code-exec-output-symlink-sandbox-escape ↗
- https://github.com/EricLBuehler/mistral.rs/blob/4400935451da5e2dc7379a3f92fbbada66557f6c/mistralrs-code-exec/src/files.rs#L241-L254 ↗
- https://github.com/EricLBuehler/mistral.rs/blob/4400935451da5e2dc7379a3f92fbbada66557f6c/mistralrs-code-exec/src/mount.rs#L30-L50 ↗
- https://github.com/EricLBuehler/mistral.rs ↗
- https://www.vulncheck.com/advisories/mistral-rs-0.9.0-through-0.9.4-sandbox-escape-via-symlink-following-in-mistralrs-code-exec ↗