CVE-2026-108940

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibrationapply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument savecimatrix results in path traversal. The attack may be initiated remotely. The...

CVE-2026-108939

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

PT-2026-96032

Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files a file:// URL, or any existing relative/absolute path. A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal ...