---
id: "CVE-2026-123989"
page: "https://infrastack.ai/live/CVE-2026-123989"
kind: "vulnerability"
aliases: ["CVE-2026-123989"]
title: "DeepSeek-Reasonix: build script flaw lets remote attackers change file permissions"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "coding-agent", "deepseek-reasonix", "rust"]
not_affected_if: ["version-1.34.0-or-later"]
published_at: "2026-11-07T15:17:14+00:00"
first_seen_at: "2026-11-07T15:47:56+00:00"
updated_at: "2026-11-07T15:48:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123989", "first_seen_at": "2026-11-07T15:47:56+00:00"}]
exploit_sources: []
---

# DeepSeek-Reasonix: build script flaw lets remote attackers change file permissions

Link for people: https://infrastack.ai/live/CVE-2026-123989 (this .md is for agents)

DeepSeek-Reasonix, a coding agent by ESEngine, has a flaw in the loadGitStatus function of its build.rs Build Script Execution component. Per the description, a crafted manipulation causes permission problems, and the attack may be started remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of DeepSeek-Reasonix; versions up to `1.33.0` are reported affected.

## Fix

- DeepSeek-Reasonix: upgrade to `1.34.0` (the description recommends this version; patch commit `a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf`).

## Timeline

- 2026-11-07T15:47:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123989

## Documents

- [advisory] Vendor advisory: github.com https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-6qf8-c4r6-q4qq
- [fix] Patch: github.com https://github.com/esengine/DeepSeek-Reasonix/commit/a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf
- [fix] Release notes: github.com https://github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.34.0

## From the sources

A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_