The elixir-tesla tesla library versions 0.8.0 through before 1.18.3 have an improper encoding or escaping vulnerability (CWE-116) in multipart part header construction. Specifically, Tesla.Multipart.part_headers_for_disposition/1 directly interpolates disposition parameters into the Content-Disposition header without sanitizing CR (\r), LF (\n), or double-quote characters. This allows an attacker to inject additional headers or manipulate multipart boundaries by including these characters in parameters such as filename or name, which are passed verbatim from caller functions like Tesla.Multipart.add_field/4 and Tesla.Multipart.add_file/3. The default filename extraction does not strip CR or LF characters, further enabling this injection if attacker-controlled file paths are forwarded. This vulnerability can lead to multipart part header injection but has a low CVSS score of 2.1 and no known exploits in the wild.

The vulnerability allows injection of multipart part headers via unescaped Content-Disposition parameters, potentially enabling an attacker to forge headers or manipulate multipart message structure. However, the impact is limited due to the low CVSS score (2.1) and the requirement for local access or partial control of input parameters. There are no known exploits in the wild, and the vulnerability does not lead to remote code execution or privilege escalation by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid passing untrusted input directly to multipart disposition parameters or sanitize inputs to remove CR, LF, and double-quote characters before use. Monitor the elixir-tesla project for updates and apply official patches once released.