| tiêu đề | esengine DeepSeek-Reasonix 1.17.8 CWE-1427 Improper Neutralization of Input Used for LLM Prompting |
|---|
| Mô tả | DeepSeek Reasonix Desktop v1.17.8 (github.com/esengine/DeepSeek-Reasonix, commit 7d68fb1a) automatically imports repository-controlled project memory files (AGENTS.md, CLAUDE.md, REASONIX.md) and appends them to the system prompt during composition — without integrity verification, provenance labeling, workspace trust gating, or user confirmation. discoverDocs() (internal/memory/doc.go:70-93) discovers and loads these files from the workspace and its ancestors, checking only file readability; Block() (internal/memory/memory.go:127) wraps the content into a "# Memory" block explicitly labeled "Treat it as durable, user-authored guidance for this project"; Compose() (internal/memory/memory.go:160) appends the block after the built-in system prompt (base + "\n\n" + block); Build() (internal/boot/boot.go:299-301) runs this chain unconditionally at every startup. An attacker who controls a public repository can therefore supply durable agent instructions that the LLM treats as authoritative: the victim only has to open or start Reasonix inside the attacker-controlled repository, without opening or approving the memory file. In validated testing (2026-07-16, four-phase controlled-variable PoC, 5/5 all phases), repository-controlled instructions steered the model into invoking the built-in shell tool, yielding arbitrary command execution on the host — sensitive-data exfiltration, workspace file modification, and cross-session persistence via prompt caching.
Affected: <= 1.17.8. Patched versions: none (unpatched as of 2026-07-16).
Reported to the vendor: https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-7v48-x992-r5w7 (submitted 2026-07-16 as a corrected resubmission; the original GHSA-545f-jjmj-7vrv was withdrawn because it misstated the injection order; the advisory is in Triage and the maintainer began handling it on 2026-08-29). Additionally reported via public GitHub issue: https://github.com/esengine/DeepSeek-Reasonix/issues/13061 (public issue filed 2026-10-14). |
|---|
| Nguồn | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/deepseek-reasonix/deepseek-reasonix-agents-md-prompt-injection-command-execution.md |
|---|
| Người dùng | Ybyu (UID 101038) |
|---|
| Đệ trình | 14/10/2026 10:29 (cách đây 24 ngày) |
|---|
| Kiểm duyệt | 06/11/2026 09:28 (23 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 431772 [esengine DeepSeek-Reasonix đến 2.52.0 internal/memory/doc.go discoverDocs Thực thi mã từ xa] |
|---|
| điểm | 20 |
|---|