mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

Advisories

mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

severity: high
date: 10/11/2026
Affecting: mistral.rs >= 0.9.0, <= 0.9.4
CVE: CVE-2026-108759
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSS: 7.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind03/ericlbuehler-mistralrs-code-exec-output-symlink-sandbox-escape
https://github.com/EricLBuehler/mistral.rs/blob/4400935451da5e2dc7379a3f92fbbada66557f6c/mistralrs-code-exec/src/files.rs#L241-L254
https://github.com/EricLBuehler/mistral.rs/blob/4400935451da5e2dc7379a3f92fbbada66557f6c/mistralrs-code-exec/src/mount.rs#L30-L50
https://github.com/EricLBuehler/mistral.rs
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo