CVE-2026-102437 in DeepSeek-Reasonix
Summary
by MITRE • 09/29/2026
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an OS Command Injection flaw within the internal gitcmd module of esengine DeepSeek-Reasonix, specifically affecting Reasonix Studio, represents a critical security risk for local users who possess control over repository content. This defect arises from the improper handling of configuration files and attribute definitions during the execution of Git operations, particularly when invoking filter.clean or filter.smudge processes. The core technical flaw lies in the application's failure to sanitize inputs derived from .gitattributes and .git/config files before passing them to underlying system commands. When a user opens a workspace that contains these manipulated configuration files, the desktop application parses their contents without adequate validation, allowing an attacker who controls the repository content to inject arbitrary operating system commands into the execution pipeline of the diff viewer functionality.
From a technical perspective, Git allows users to define custom filters for cleaning and smudging data during checkout or commit operations via the .gitattributes file. These filters can reference external scripts or executables defined in the .git/config file. In this specific implementation within Reasonix Studio, the internal gitcmd module appears to construct shell commands dynamically based on these configurations without escaping special characters or restricting allowed command sets. Consequently, if an attacker modifies the repository's metadata files to point filter.smudge or filter.clean directives toward a malicious script containing payload code, the application will execute this code with the privileges of the currently logged-in user when rendering workspace changes in the diff viewer. This mechanism bypasses traditional network-based attack vectors since it relies entirely on local file system access and social engineering tactics such as convincing users to open untrusted repositories or clone compromised projects into their development environment.
The operational impact of this vulnerability is significant, particularly for developers and security professionals who frequently interact with external codebases. An attacker can achieve arbitrary command execution on the victim's machine by simply getting them to view changes in a maliciously crafted repository through Reasonix Studio. This could lead to full system compromise if the user runs the application with elevated privileges or if the injected commands exploit other local vulnerabilities for privilege escalation. Data exfiltration, installation of persistent backdoors, and lateral movement within internal networks are all plausible outcomes following successful exploitation. The attack vector is classified as Local because it requires physical or logical access to modify repository files before they are opened in the IDE, making detection difficult without strict monitoring of file system activities and process creation events.
This vulnerability aligns with Common Weakness Enumeration CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The exploitation technique corresponds to ATT&CK tactic T1059 Command and Scripting Interpreter, specifically leveraging subcomponents like sh or cmd depending on the operating system where Reasonix Studio is deployed. To mitigate this risk, developers should implement strict allow-lists for permitted filter scripts rather than relying on blacklist approaches which are prone to bypasses. Input validation must be enforced at multiple layers, ensuring that any data read from configuration files is sanitized before being passed to shell interpreters. Additionally, running the application with least-privilege principles can limit the damage caused by successful command injection. Users should exercise caution when opening repositories from untrusted sources and consider using isolated virtual environments or containers for reviewing potentially malicious codebases until patches are released.