Evidence · DiggingBeagle record
Advisory: Mistral.rs parser interprets attacker-quoted XML delimiters as additional tool calls
An attacker-controlled document included XML-style tool-call delimiters that a model quoted as data. The Mistral.rs tool parser subsequently treated those bytes as structural commands and could emit another declared tool invocation. GHSA-34w8-j94f-8c5w documents tool-call parsing confusion; it does not grant arbitrary shell execution unless the target tool is already available. Advisory version boundaries differ between reports; 0.9.5 is the conservative fixed target. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
An attacker-controlled document included XML-style tool-call delimiters that a model quoted as data. The Mistral.rs tool parser subsequently treated those bytes as structural commands and could emit another declared tool invocation. GHSA-34w8-j94f-8c5w documents tool-call parsing confusion; it does not grant arbitrary shell execution unless the target tool is already available. Advisory version boundaries differ between reports; 0.9.5 is the conservative fixed target. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsMistral.rs tool parser turned quoted XML delimiters into tool invocations: GHSA-34w8-j94f-8c5w documents tool-call parsing confusion; it does not grant arbitrary shell execution unless the target tool is already available. Advisory version boundaries differ between reports; 0.9.5 is the conservative fixed target.
GHSA-34w8-j94f-8c5w; parser confusion; version disclosures
- supportsMistral.rs tool parser turned quoted XML delimiters into tool invocations: An attacker-controlled document included XML-style tool-call delimiters that a model quoted as data. The Mistral.rs tool parser subsequently treated those bytes as structural commands and could emit another declared tool invocation.
GHSA-34w8-j94f-8c5w; parser confusion; version disclosures