CVE-2026-123989 Details
Description
A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.
A vulnerability in ESEngine DeepSeek-Reasonix versions through 1.33.0 allows for unauthorized execution of GitHub Actions on the host machine. This issue arises because 'cargo check' is mistakenly classified as a read-only command, when in fact it executes 'build.rs'—a script that can perform arbitrary actions. The vulnerability is exploited by cloning a malicious repository, which, when processed by DeepSeek-Reasonix, triggers the execution of the 'build.rs' script outside of the intended sandbox environment, leading to unauthorized actions being performed on the host system.
Users are advised to upgrade to DeepSeek-Reasonix version 1.34.0, which addresses this vulnerability by removing 'cargo check' from the read-only whitelist, routing 'loadGitStatus' through the sandbox, and optionally narrowing the session grant rules for file-writing tools.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/esengine/DeepSeek-Reasonix/ | [email protected] | Vendor |
| https://github.com/esengine/DeepSeek-Reasonix/commit/a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf | [email protected] | Source CodeVendor |
| https://github.com/esengine/DeepSeek-Reasonix/pull/9599 | [email protected] | Issue TrackingVendor |
| https://github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.34.0 | [email protected] | Release NotesVendor |
| https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-6qf8-c4r6-q4qq | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-123989 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1035343 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432064 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432064/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-275 | Permission Issues | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ESEngine DeepSeek-Reasonix | < 1.34.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | New CVE Received | [email protected] |