CVE-2026-123653 in DeepSeek-Reasonix
Summary
by MITRE • 11/06/2026
A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in esengine DeepSeek-Reasonix versions up to 2.52.0 represents a critical security flaw within the internal memory management subsystem, specifically located in the discoverDocs function of the file internal/memory/doc.go. This issue stems from an improper neutralization of user-supplied input that is subsequently utilized for large language model prompting. In modern software architectures involving artificial intelligence components, inputs destined for LLM prompts are particularly sensitive because they can influence model behavior, data retrieval logic, and output generation. When such inputs are not properly sanitized or validated before being processed by the underlying engine, it creates an opportunity for malicious actors to inject harmful payloads that bypass standard security controls.
The technical nature of this flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, although in the context of LLM integration, it often manifests as a form of prompt injection or indirect command execution depending on how the engine interprets the input. The discoverDocs function is responsible for locating and retrieving documentation resources within the system's memory space. By failing to adequately sanitize inputs passed through this pathway, the application allows an attacker to manipulate the context in which the LLM operates. This can lead to unauthorized access to internal data structures, leakage of sensitive information processed by the model, or even remote code execution if the engine passes these manipulated prompts to external tools or scripts for further processing.
From a threat actor perspective, this vulnerability is particularly dangerous because it allows for remote exploitation without requiring prior authentication in many configurations. The ability to initiate attacks remotely significantly expands the attack surface, making systems running vulnerable versions of esengine DeepSeek-Reasonix accessible targets from across the internet. Furthermore, since the exploit has been disclosed publicly and proof-of-concept code may be available, automated scanning tools and opportunistic attackers are likely already targeting these vulnerabilities in real-time environments. This public disclosure elevates the risk profile substantially, as defenders must assume that active exploitation attempts are occurring against unpatched systems immediately upon publication of the vulnerability details.
The operational impact of this vulnerability extends beyond simple data leakage. Successful exploitation can compromise the integrity and confidentiality of the entire AI-driven application stack. Attackers could potentially force the LLM to generate malicious code, exfiltrate proprietary documentation stored in memory, or disrupt service availability by causing the engine to enter an unstable state through malformed inputs. In enterprise environments where esengine is used for automated reasoning or document analysis, this vulnerability undermines trust in the system's outputs and can lead to significant business disruption if critical decisions are based on compromised AI-generated content.
To mitigate these risks, immediate action is required to update the affected component to version 2.53.0 or later. The patch associated with commit identifier 4ca33493a673c2788aa8598fbca2b2f47a69e1b8 specifically addresses this input validation deficiency by implementing stricter sanitization protocols within the discoverDocs function. Organizations should prioritize applying this update across all production and staging environments to close the remote exploitation vector. Additionally, it is advisable to implement defense-in-depth strategies such as network-level filtering of LLM inputs, runtime application self-protection mechanisms that detect anomalous prompt patterns, and regular security audits focusing on AI-specific attack vectors like prompt injection. Monitoring for indicators of compromise related to unusual memory access patterns or unexpected model outputs can also help in detecting potential exploitation attempts before significant damage occurs.