EUVD-2026-88756
GHSA-8rx4-qgjw-3jvq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft repo with malicious .gitattributes + .git/config
-
DeliveryDeliver repo to victim (clone/share)
-
ExploitVictim opens workspace-changes diff viewer
-
Executiongit invokes filter.clean/smudge command
-
ImpactArbitrary command execution as local user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to control repository content - specifically a crafted .gitattributes registering a clean/smudge filter plus a .git/config binding that filter to an arbitrary command - and requires the victim to open that repository's workspace-changes diff viewer in the DeepSeek-Reasonix (Reasonix Studio) desktop app, which invokes git diff and triggers the filter. Limiting factors: exploitation is strictly local (AV:L), needs user interaction (opening/viewing the malicious repo), and depends on the victim trusting and loading an attacker-supplied repository; there is no remote or unauthenticated network path despite PR:N. |
| Impact | This is a genuine local privilege/code-execution risk but requires attacker-controlled repository content plus a victim action, so it is not a mass-exploitable network flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: exploitation is local, requires no authentication to the app itself, but hinges on user interaction - the victim must open a malicious repository in the desktop app's workspace-changes diff viewer. The PR:N is technically correct (no app credentials needed) but is effectively gated by UI:R plus the prerequisite that the attacker controls the repo's .gitattributes and .git/config, which materially narrows real-world exploitability. No EPSS score, no CISA KEV listing, and no explicit POC flag are provided; a GitHub Security Advisory (GHSA-grg2-7gc6-36m6) exists but the input does not confirm exploit code, so exploitation status is 'no public exploit identified at time of analysis.' Net: high technical impact (full arbitrary command execution as the user) but a narrow, interaction- and configuration-dependent trigger against a niche product - a moderate real-world priority, not a widespread emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious Git repository containing a .gitattributes file that registers a clean/smudge filter and a .git/config that maps that filter to an attacker-supplied shell command, then lures a developer into cloning and opening it in DeepSeek-Reasonix (Reasonix Studio). When the victim views workspace changes in the diff viewer, the app invokes git diff, which triggers the filter and executes the embedded command with the user's privileges. No public exploit code is confirmed in the provided data, though a GitHub Security Advisory documents the issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
OS command injection in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls a repository's contents to execute arbitrary commands with the privileges of the desktop application's diff viewer. The attacker supplies a crafted .gitattributes file that registers a clean/smudge filter plus a .git/config that binds that filter driver to an arbitrary shell command; when the victim opens that repository's workspace-changes diff view, the app's internal/gitcmd module runs git diff and the malicious filter is executed. Exploitation is strictly local (AV:L) and requires user interaction - the victim must open or view the attacker-supplied repository - and no public exploit code or confirmed active exploitation has been identified at time of analysis, so the risk is genuine but bounded rather than a mass-exploitable network flaw.
RemediationAI
Update DeepSeek-Reasonix to the release referenced in vendor advisory GHSA-grg2-7gc6-36m6 (https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-grg2-7gc6-36m6) as soon as a fixed build is published; because the CPE data uses a wildcard version, verify the exact patched version in that advisory rather than assuming the latest build is fixed, and if the advisory lists only an upstream fix rather than a tagged release, treat the fix as unreleased upstream code. Until a patch is confirmed, treat every untrusted repository as executable content: do not open repositories supplied by third parties in the desktop app's diff viewer, and if they must be inspected, open them on a disposable sandboxed or containerized host or VM with no access to credentials or sensitive data. Additional compensating controls with trade-offs: pre-sanitize untrusted repositories by deleting or neutralizing .gitattributes and any filter.* entries in .git/config before loading them into the app (this breaks legitimate Git LFS and other filter-backed repositories), or run the diff viewer with Git attribute/filter processing disabled at the command level, for example by clearing the attribute source (GIT_ATTR_NOSYSTEM plus an empty core.attributesFile) or overriding filter configuration with empty -c filter.<driver>.clean=/smudge= values, which prevents the injected command from executing but removes filter-based normalization and may produce misleading diffs for repositories that rely on filters. Reducing the app's process privileges (running it as a low-privileged account, denying it access to SSH keys, tokens and cloud credentials) limits the blast radius because injected commands inherit the app's privileges. No vendor-released patch version has been confirmed from the available data, so monitor the advisory URL for the corrected release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic OS command injection (CWE-78) rooted in Git's extensible filter mechanism. Git supports clean and smudge filters declared in .gitattributes (for example '*.txt filter=myfilter') and bound to shell commands in .git/config under filter.<driver>.clean / filter.<driver>.smudge or filter.<driver>.process. When git diff compares a worktree file against the index it normalizes the worktree content by running the configured clean filter, which means a diff operation - not just checkout or add - can spawn an attacker-chosen command through the shell. DeepSeek-Reasonix's internal/gitcmd component invokes git diff to render the workspace-changes view but does not neutralize or strip repository-supplied filter configuration, so command strings taken from attacker-controlled repository metadata reach a shell. Both inputs needed for exploitation (.gitattributes and .git/config) live inside the repository an attacker can distribute, and the CPE entry cpe:2.3:a:esengine:deepseek-reasonix:*:*:*:*:*:*:*:* uses a wildcard version, indicating no specific patched build has been enumerated in the CPE data. The reported-by source is GitLab and the vendor advisory is GHSA-grg2-7gc6-36m6 on the esengine/DeepSeek-Reasonix project.
Know when Deepseek Reasonix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local trigger via a malicious repo opened by the victim (AV:L, UI:R); no app credentials needed (PR:N); git filter yields full arbitrary command execution as the user, so C/I/A:H.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.
Technical POC Analysis
Evidence base: GitHub advisory GHSA-grg2-7gc6-36m6 (esengine/DeepSeek-Reasonix).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity command injection flaw in esengine DeepSeek-Reasonix (Reasonix Studio) lets a crafted repository execute arbitrary commands with the privileges of the desktop application's diff viewer. The risk is concentrated on developer workstations and source-code integrity, because a user must open the malicious repository and no vendor patch is currently available. Leadership should prioritize preventing users from opening untrusted repositories while tracking the vendor for remediation.
No vendor-released patch identified at time of analysis; interim mitigations include prohibiting opening untrusted repositories in Reasonix Studio, disabling or sandboxing its diff-viewer and git integration where possible, applying least privilege to the desktop application, and monitoring for unexpected child processes spawned during diff viewing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB