{"id":"CVE-2026-123989","kind":"vulnerability","aliases":["CVE-2026-123989"],"related":[],"title":"DeepSeek-Reasonix: build script flaw lets remote attackers change file permissions","description":"A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.","summary":"DeepSeek-Reasonix, a coding agent by ESEngine, has a flaw in the loadGitStatus function of its build.rs Build Script Execution component. Per the description, a crafted manipulation causes permission problems, and the attack may be started remotely.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","coding-agent","deepseek-reasonix","rust"],"not_affected_if":["version-1.34.0-or-later"],"how_to_check":"- Check the installed version of DeepSeek-Reasonix; versions up to `1.33.0` are reported affected.","fix":"- DeepSeek-Reasonix: upgrade to `1.34.0` (the description recommends this version; patch commit `a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf`).","status":"open","published_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:56+00:00","triaged_at":"2026-11-07T15:48:09+00:00","updated_at":"2026-11-07T15:48:09+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-07T15:48:09Z","model":"claude-haiku-5-5","output":{"fix":"- DeepSeek-Reasonix: upgrade to `1.34.0` (the description recommends this version; patch commit `a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf`).","reach":"internet","title":"DeepSeek-Reasonix: build script flaw lets remote attackers change file permissions","impact":"medium","summary":"DeepSeek-Reasonix, a coding agent by ESEngine, has a flaw in the loadGitStatus function of its build.rs Build Script Execution component. Per the description, a crafted manipulation causes permission problems, and the attack may be started remotely.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["deepseek-reasonix","coding-agent","rust"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Permissions on files may be changed by a remote attacker","analyst_note":"Confirm the attack path and privilege needed for the loadGitStatus build.rs permission flaw using the NVD entry and the linked vendor advisory and release notes.","how_to_check":"- Check the installed version of DeepSeek-Reasonix; versions up to `1.33.0` are reported affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.34.0-or-later"],"who_is_affected":"Teams running DeepSeek-Reasonix up to version 1.33.0 are in scope. The sources do not say which deployment paths or configurations make the flaw reachable, so exposure beyond the version range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4328,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123989':15A,18A '-2026':14A,17A '1.33.0':78C '1.34.0':110C 'a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf':121C 'address':114C 'affect':126C 'agent':24B,34B 'ai':20B 'ai-tool':19B 'attack':9A,62B,102C 'build':4A,47B,91C 'build.rs':46B,87C 'caus':57B 'chang':10A 'code':23B,33B 'coding-ag':22B 'compon':50B,90C,127C 'craft':55B 'cve':13A,16A 'deepseek':2A,26B,30B,74C 'deepseek-reasonix':1A,25B,29B,73C 'descript':53B 'esengin':36B,72C 'execut':49B,93C 'file':11A,86C 'flaw':6A,39B 'found':70C 'function':43B,82C 'impact':79C 'initi':105C 'issu':100C,116C 'let':7A 'loadgitstatus':42B,83C 'manipul':56B,96C 'may':63B,103C 'name':120C 'patch':118C 'per':51B 'perform':94C 'permiss':12A,58B,99C 'problem':59B 'reasonix':3A,27B,31B,75C 'recommend':112C 'remot':8A,66B,106C 'result':97C 'rust':28B 'script':5A,48B,92C 'start':65B 'tool':21B 'upgrad':107C,124C 'version':109C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running DeepSeek-Reasonix up to version 1.33.0 are in scope. The sources do not say which deployment paths or configurations make the flaw reachable, so exposure beyond the version range is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","codingagent","deepseekreasonix","high","rust"],"campaign_type":null,"search_a":"'-123989':15A,18A '-2026':14A,17A 'attack':9A 'build':4A 'chang':10A 'cve':13A,16A 'deepseek':2A 'deepseek-reasonix':1A 'file':11A 'flaw':6A 'let':7A 'permiss':12A 'reasonix':3A 'remot':8A 'script':5A","search_b":"'agent':24B,34B 'ai':20B 'ai-tool':19B 'attack':62B 'build':47B 'build.rs':46B 'caus':57B 'code':23B,33B 'coding-ag':22B 'compon':50B 'craft':55B 'deepseek':26B,30B 'deepseek-reasonix':25B,29B 'descript':53B 'esengin':36B 'execut':49B 'flaw':39B 'function':43B 'loadgitstatus':42B 'manipul':56B 'may':63B 'per':51B 'permiss':58B 'problem':59B 'reasonix':27B,31B 'remot':66B 'rust':28B 'script':48B 'start':65B 'tool':21B","search_c":"'1.33.0':78C '1.34.0':110C 'a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf':121C 'address':114C 'affect':126C 'attack':102C 'build':91C 'build.rs':87C 'compon':90C,127C 'deepseek':74C 'deepseek-reasonix':73C 'esengin':72C 'execut':93C 'file':86C 'found':70C 'function':82C 'impact':79C 'initi':105C 'issu':100C,116C 'loadgitstatus':83C 'manipul':96C 'may':103C 'name':120C 'patch':118C 'perform':94C 'permiss':99C 'reasonix':75C 'recommend':112C 'remot':106C 'result':97C 'script':92C 'upgrad':107C,124C 'version':109C 'vulner':68C","cause_entry":null,"cause_path":null,"first_public_at":"2026-10-15T03:23:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123989","severity":null,"published_at":"2026-11-07T15:17:14+00:00","modified_at":"2026-11-07T15:17:14+00:00","first_seen_at":"2026-11-07T15:47:56+00:00","fetched_at":"2026-11-07T15:47:56+00:00","note":null}],"documents":[{"id":96352,"url":"https://github.com/esengine/DeepSeek-Reasonix/commit/a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96353,"url":"https://github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.34.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":96354,"url":"https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-6qf8-c4r6-q4qq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-15T03:23:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}