CVE-2026-90946: DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any DeepWiki-Open deployment where the unauthenticated /ws/chat WebSocket endpoint is reachable by an attacker is exposed. No authentication, user interaction, or prior privileges are required.
What can an attacker read?
An attacker can provide arbitrary directory paths through repo_url and read files with supported extensions. The described supported types include Python, JavaScript, YAML, and JSON, which may expose hardcoded secrets and credentials.
How can I determine whether my deployment is affected?
Deployments running DeepWiki-Open through commit d92819a are affected according to the available information. Confirm whether /ws/chat is accessible without authentication and whether its repo_url input can reference filesystem paths outside intended repository locations.