{"action":"Upgrade mistralrs-server-core to 0.8.18 or later.","affected":[{"fixed":"0.8.18","introduced":"0"}],"component":"mistralrs-server-core","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.8.18"],"ghsa_id":"GHSA-wfgq-w7cq-qj7j","id":"tcs_01M5KF41SN30BPAGAQS2C68RVW","modified_at":"2026-09-10T22:00:05.197163382Z","published_at":"2026-09-10T21:54:14Z","references":["https://osv.dev/vulnerability/GHSA-wfgq-w7cq-qj7j","https://github.com/EricLBuehler/mistral.rs/security/advisories/GHSA-wfgq-w7cq-qj7j","https://github.com/EricLBuehler/mistral.rs/commit/74793379649febc758b6a0d4b71aa6aeabc80f9c","https://github.com/EricLBuehler/mistral.rs"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-wfgq-w7cq-qj7j","url":"https://osv.dev/vulnerability/GHSA-wfgq-w7cq-qj7j"}],"summary":"mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url"}