{"data":{"id":"ce5ef3bc-9205-4f2d-b206-f0960314ee84","title":"GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package","summary":"The mistralai PyPI package version 2.4.6 contains a malicious dropper that runs on import on Linux. The code was added to src/mistralai/client/__init__.py and was not produced by the project's normal release pipeline, which uses PyPI Trusted Publishing. Versions 2.4.5 and earlier are not known to be affected.","solution":"Pin mistralai to 2.4.5 or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. git+https://github.com/mistralai/client-python.git@v2.4.5. On affected Linux hosts, rotate every credential reachable from the importing process and","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-wx9m-wx4f-4cmg","publishedAt":"2026-05-18T17:55:27.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["mistralai@= 2.4.6"],"affectedPackageNames":["mistralai"],"affectedPackageRefs":["pypi:mistralai"],"affectedVendors":["Mistral"],"affectedVendorsRaw":["mistralai PyPI package","Mistral AI client SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-wx9m-wx4f-4cmg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-05-18T17:55:27.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}