DeepWiki-Open CVE-2026-90946

Exploitation requires the DeepWiki-Open /ws/chat WebSocket endpoint to be network-reachable by the attacker and to have no authentication layer in front of it - the CVSS 4.0 vector is PR:N/UI:N, so no credentials and no user interaction are needed. The attacker must supply an absolute or traversal directory path in the repo_url field of the chat message, and the server process must have read permission on the target files; only files with the pipeline's supported extensions (Python, JavaScript, YAML, JSON) are parsed, so the exfiltration is limited to those types. Limits on real-world exploitation: instances bound to loopback, sitting behind an authenticating reverse proxy, or running in a container with a read-only or narrowly mounted filesystem expose far less; a source checkout pinned to a commit after a future fix is not affected, and the absence of integrity or availability impact means exploitation cannot directly alter or crash the service.

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H and no integrity or availability impact, and that maps to a CVSS 3.1 equivalent of roughly 7.5 - high severity, but a confidentiality-only primitive, not the remote code execution implied by the 'RCE' tag in the source metadata. The compensating factor is exposure: exploitation requires the WebSocket endpoint to be reachable from the attacker's network, so an instance bound to localhost, behind an authenticating reverse proxy, or inside a container with a read-only, narrowly mounted filesystem is largely unaffected, whereas one published to the internet is trivially harvestable by a script - even a mid-sized municipal IT team in legnica running a public demo instance should treat this as urgent. SSVC rates exploitation as 'poc' and automatable as 'yes' with partial technical impact, which supports rapid, scripted mass scanning; EPSS and KEV data are absent from this feed, so the precise probability of exploitation and whether real-world attacks have occurred are NOT confirmed - do not conflate the PoC signal with confirmed active exploitation. Note also the mild tension between CWE-73 and the tag set: the underlying CWE and the impact metrics describe information disclosure, not code execution.

An attacker opens a WebSocket connection to the publicly reachable /ws/chat endpoint of a hosted DeepWiki-Open instance and sends a chat/repo_url message containing an absolute path such as / or /app or a home directory. The server resolves that path as the repository to index and walks it, returning the contents of matching .py, .js, .yaml and .json files over the same socket. Because the request is a single unauthenticated message with no timing or race conditions, the whole harvest can be scripted across thousands of hosts; the SSVC 'poc' status indicates exploit code is circulating.