CVE-2026-108759 in mistral.rs
Summary
by MITRE • 10/11/2026
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in mistral.rs versions 0.9.0 through 0.9.4 represents a critical security flaw within the code execution subsystem, specifically affecting the handling of file system operations during sandboxed shell command execution. This issue stems from an improper validation and sanitization process regarding symbolic links when determining output destinations or input sources for executed commands. In typical secure implementations, sandboxes are designed to restrict processes to a specific directory tree, preventing access to sensitive host files. However, in this flawed implementation, the system fails to adequately resolve or block symbolic links that point outside the designated sandbox boundary. This allows an attacker who has gained control over the input parameters of the code execution feature to manipulate file paths using symlinks, effectively bypassing the isolation mechanisms intended to contain the shell environment.
From a technical perspective, the core flaw lies in how the application resolves path components before executing commands or writing output files. When a user provides a filename for an output destination or specifies an input file via a session reuse mechanism, the system does not strictly enforce that the resolved absolute path remains within the allowed sandbox directory. By creating a symbolic link inside the sandbox that points to a target location outside of it, such as /etc/passwd or other sensitive configuration files, an attacker can trick the server process into reading from or writing to these restricted locations. Since the shell command executes with the permissions of the mistral.rs server process, any file access performed through this symlinked path inherits those elevated privileges, leading to unauthorized data exposure or system modification.
The operational impact of this vulnerability is severe, particularly in environments where mistral.rs is deployed as a service handling untrusted user inputs or agent-driven workflows. Prompt-injected agents, which are AI models manipulated by malicious prompts to perform unintended actions, can exploit this flaw to exfiltrate sensitive data from the host system. Furthermore, attackers could overwrite critical configuration files or scripts located outside the sandbox, potentially leading to further compromise of the underlying infrastructure. This capability undermines the fundamental security guarantee provided by containerization and sandboxing techniques, allowing lateral movement within the file system hierarchy based on the privileges of the running service account rather than a restricted user context.
This vulnerability aligns with CWE-59 Improper Link Resolution Before File Access, as it involves the exploitation of symbolic links to bypass access controls. Additionally, from an offensive security framework perspective, this behavior is consistent with ATT&CK technique T1083 File and Directory Discovery, where adversaries explore the system for sensitive information, and potentially T1496 Resource Hijacking or data exfiltration if used in conjunction with other exploits. The ability to read files outside the sandbox facilitates reconnaissance and credential theft, while overwriting capabilities could lead to persistence mechanisms or denial of service conditions by corrupting essential system files.
To mitigate this risk, immediate updates to mistral.rs beyond version 0.9.4 are required if a patched release is available that addresses path resolution logic. In the interim, administrators should enforce strict file access controls at the operating system level using tools like SELinux or AppArmor to restrict what paths the server process can access regardless of application-level checks. It is also advisable to disable code execution features entirely in production environments unless absolutely necessary and strictly validated. Input validation strategies must be enhanced to resolve all symbolic links before processing them, ensuring that the final resolved path resides within an explicitly whitelisted directory tree. Regular security audits focusing on file system interactions in AI-driven applications are recommended to identify similar bypasses in other components of the stack.