CVE-2026-108939Medium· 5.3▾ Sunlit

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score29/ 100 · Low

impact 29.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 13, 2026

Updated

Oct 15, 2026

CVSS

5.3

Vendor

EricLBuehler

Product

mistral.rs

CWE

CWE-918

Depth score

29 · Low

EPSS

0.47% · p41

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

decided 2026-10-15

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 13.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 2 days

Oct 13, 2026Published
Disclosed via NVD
Oct 13, 2026EPSS first tracked
0.5%
Oct 15, 2026Record revised
Last analysed / modified upstream

EricLBuehler CWE-918 #nvd #cve.org

Affected

mistral.rs 0.9.0
mistral.rs 0.9.1
mistral.rs 0.9.2
mistral.rs 0.9.3

Full technical detail▾

Overview

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed