Mistral.rs tool parser turned quoted XML delimiters into tool invocations

An attacker-controlled document included XML-style tool-call delimiters that a model quoted as data. The Mistral.rs tool parser subsequently treated those bytes as structural commands and could emit another declared tool invocation.

GHSA-34w8-j94f-8c5w documents tool-call parsing confusion; it does not grant arbitrary shell execution unless the target tool is already available. Advisory version boundaries differ between reports; 0.9.5 is the conservative fixed target.

The injection was carried by text that should have been treated as quoted data. An external document contained XML-looking closing delimiters matching a tool-call serialization format. When the model reproduced that text, mistral.rs's parser could treat the embedded delimiters as structure and emit an additional call to an already declared tool. The model does not need permission to create an entirely new tool for this to matter; it can redirect an available one. Reports differ on the earliest corrected version, so the conservative verified patch baseline should be checked against 0.9.5 rather than confidently declaring all 0.9.3 builds safe. There is no disclosed in-the-wild campaign and no automatic shell execution in the absence of a declared effectful tool.

The model may quote hostile text as ordinary source material, yet a downstream tool parser can reinterpret those same bytes as control syntax. This moves the exploit from the model's intent to the serialization boundary between prose and declared tool calls. The advisory requires an already available tool, and version guidance differs between disclosures; targeting 0.9.5 is the conservative reported fix. Tests should compare the raw generated message with the final structured calls to ensure quoted XML-style delimiters cannot manufacture a second invocation.