CVE-2026-123989 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
DeepSeek-Reasonix, a coding agent by ESEngine, has a flaw in the loadGitStatus function of its build.rs Build Script Execution component. Per the description, a crafted manipulation causes permission problems, and the attack may be started remotely.
first public Oct 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running DeepSeek-Reasonix up to version 1.33.0 are in scope. The sources do not say which deployment paths or configurations make the flaw reachable, so exposure beyond the version range is unknown.
Not affected if version-1.34.0-or-later
Who cares coding-agent, deepseek-reasonix, rust
1.33.0 are reported affected.1.34.0 (the description recommends this version; patch commit a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf).A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.