GHSA-wfgq-w7cq-qj7j

### Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a `file://` URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI `image_url` / `audio_url` message content. The server is unauthenticated by default. ### Details `parse_image_url` in `mistralrs-server-core/src/util.rs` (lines 45-88) resolves the request string and fetches/opens it: ```rust let url = if let Ok(url) = url::Url::parse(url_unparsed) { url } else if File::open(url_unparsed).await.is_ok() { // a bare existing path (relative or absolute) url::Url::from_file_path(std::path::absolute(url_unparsed)?) ... } else { bail!(...) }; let bytes = if url.scheme() == "http" || url.scheme() == "https" { reqwest::get(url.clone()).await ... // SSRF: no host/IP/allowlist check } else if url.scheme() == "file" { File::open(path).await ... read // arbitrary local file read } else if url.scheme() == "data" { ... base64 ... }; ``` `reqwest::get` has no allowlist, no private/loopback/link-local/metadata block, and follows redirects by default. The `file` scheme (and any bare path that already exists on the server, resolved at line 48) is opened and read. `parse_audio_url` (line 91) is identical for `audio_url`. The value reaches this unvalidated: `mistralrs-server-core/src/chat_completion.rs` calls `parse_image_url(&url_unparsed)` / `parse_audio_url(&url_unparsed)` on the chat message content, at request time. For reference, vLLM gates outbound media domains (`allowed_media_domains`) and local paths (`allowed_local_media_path`); mistral.rs has neither. ### Suggested fix Restrict request-supplied media to `http(s)` and `data:`; do not resolve bare strings to local files