All vulnerabilities
CVE-2026-102437GHSA-grg2-7gc6-36m6

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

esengine DeepSeek-Reasonix
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.99%Chance of exploitation activity in the next 30 days, higher than 62% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.21.0Also 1.39.3CVE List
Published29 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

Text from CVE List

Affected versions 2

  • DeepSeek-Reasonixaffected: all versions before 2.21.0CVE List
  • DeepSeek-Reasonixaffected: all versions before 1.39.3CVE List

References 2