GHSA-wfgq-w7cq-qj7j: mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

Summary

mistral.rs fetches request-supplied image and audio URLs through parse_image_url and parse_audio_url in mistralrs-server-core/src/util.rs without host, IP or allowlist checks, and opens file:// URLs and existing bare paths on the server. Because the server is unauthenticated by default, a remote client sending image_url or audio_url content can trigger server-side requests to internal or cloud-metadata addresses (SSRF) and read arbitrary local files. The error messages differ between existing and nonexistent paths, which lets an attacker probe which files exist.

Mitigation

Suggested fix: restrict request-supplied media to http(s) and data:, stop resolving bare strings to local files and stop honoring the file scheme from request input (gate local media behind an explicit, default-disabled option). Before fetching http(s), resolve the host, reject non-global IPs, pin the connection to the validated IP and re-validate or disable redirects. Cap the read size.

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database