mistral.rs contains a delimiter injection flaw in the mistralrs-core output parsers that permits an attacker to inject tool call tags such as </tool_call> into text that the model quotes. By doing so the model will generate additional calls to declared tools with arguments that the attacker specifies. This ability can lead to the execution of unintended or malicious tool operations within the host environment.

The vulnerability affects the mistral.rs framework provided by EricLBuehler. All releases prior to version 0.9.5 are vulnerable; versions 0.9.5 and later incorporate a fix that removes the ability to parse injected delimiters.

The CVSS score of 2.3 indicates a low severity under the standard metric set. No EPSS score is available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is the injection of delimiter strings through any content that the model processes—such as documents, web page text, or tool outputs. This requires that the attacker can control that content, but does not necessitate additional privileges or network connectivity. Consequently, the risk is limited to environments that process untrusted input without proper sanitization.