The elixir-tesla tesla library versions 0.8.0 up to but not including 1.18.3 contain a CWE-116 vulnerability where multipart part headers are improperly encoded or escaped. Specifically, Tesla.Multipart.part_headers_for_disposition/1 constructs Content-Disposition headers by interpolating parameters without sanitizing CR (\r), LF (\n), or double-quote characters. This allows an attacker controlling these parameters to inject additional headers or manipulate the multipart message structure. The issue affects parameters passed via Tesla.Multipart.add_field/4, Tesla.Multipart.add_file/3, and Tesla.Multipart.add_file_content/4, including filenames derived from Path.basename/1 which does not remove CR or LF characters.

The vulnerability could allow an attacker to inject multipart part headers by including special characters in Content-Disposition parameters, potentially leading to malformed multipart requests or responses. However, the CVSS score of 2.1 and the low severity rating indicate limited impact, with no direct evidence of privilege escalation, remote code execution, or data disclosure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.18.3, upgrading to version 1.18.3 or later (if available) is recommended once confirmed. Until then, users should avoid passing untrusted input directly into Content-Disposition parameters or sanitize input to remove CR, LF, and double-quote characters. Monitor vendor communications for an official fix or guidance.