CVE-2026-102437: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reasonix Studioto a version that resolves this vulnerability.Fixed in 2.21.0 - Upgrade
Upgrade
reasonix npm packageto a version that resolves this vulnerability.Fixed in 1.39.3
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of the desktop application are exposed when they view workspace changes for a repository whose .gitattributes and .git/config are controlled by a local attacker. The issue is triggered through the workspace-changes diff viewer.
What access and interaction does an attacker need?
The attacker needs control of repository content, specifically .gitattributes and .git/config. The supplied severity vector identifies local access, low attack complexity, no required privileges, and required user interaction.
What is the potential impact if exploitation succeeds?
An attacker can execute arbitrary commands through the desktop application. The supplied severity vector rates confidentiality, integrity, and availability impact as high.