mistral.rs advisory: quoted document text could become an extra tool call. Update to 0.9.5

mistral.rs, the Rust LLM inference engine we covered in its Qwen3.8-Flash-Next release, has a published security advisory that slipped past most trackers: GHSA-34w8-j94f-8c5w, rated Moderate, published 18 October. It was reported by Taehun Kim and Youngjoo Shin.

The bug

mistralrs-core found tool calls by searching the decoded text for delimiters such as <tool_call> and <parameter=...>. For the qwen-xml and gemma4 formats, a document the model quotes (a support ticket, a web page, another tool’s output) could close the real argument and open a second, valid-looking tool call. In the reporters’ words: “The model emits one call, but mistralrs-core returns two.” For gemma4 this worked “even when the document uses the format’s documented escape sequence”.

The reasoning span had the same problem. Quoted text could end the reasoning block early, and the rest could then be parsed as a tool call “even though the model produced no tool call”.

This is the parser-side twin of a prompt injection. The model did nothing wrong; the engine invented the call from untrusted bytes.

The limits

• The forged tool name “must already be declared”. An undeclared name such as bash is dropped.
• The reporters write: “we do not claim arbitrary code execution or denial of service.” The real effect depends on what your declared tools can do.
• They note that setups combining many MCP servers’ tools leave more tools reachable.

What to do

The fix is v0.9.5, released 19 October, whose notes include PR #2455: “only honor tool-call and reasoning delimiters emitted as special tokens”. Two catches:

• The advisory lists affected versions as below 0.9.3 and patched versions as 0.9.5 or later; it does not say how 0.9.3 and 0.9.4 are classed. The fix landed after the 0.9.4 release and first shipped in 0.9.5, so upgrade to 0.9.5 or later.
• On crates.io, mistralrs-core still tops out at 0.8.1 (April). Rust users get the fix from GitHub; the mistralrs Python package on PyPI is at 0.9.5.

The advisory has no CVE, and GitHub’s global advisory database does not list it, so Dependabot will not warn you. Check your version by hand.