AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-wfgq-w7cq-qj7j: mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseSeptember 10, 2026

Summary

mistral.rs has a critical security flaw where it fetches any image or audio URL provided by users without checking what hosts or IP addresses are being accessed, and it also opens arbitrary files from the server's storage. An unauthenticated attacker can exploit this to make the server request internal or cloud-metadata services (SSRF, or server-side request forgery, where a server is tricked into making unwanted requests) and read any local files on the system.

Solution / Mitigation

The source suggests restricting media requests to only http(s) and data: URLs, blocking the file:// scheme and bare file paths from user input. Before fetching http(s) URLs, validate that the host resolves to a public IP address and reject private, loopback, link-local, or metadata IPs. Pin connections to the validated IP, re-validate any redirects (or disable them), and limit the amount of data read. Local file access should only be allowed through an explicit option that is disabled by default.