CVE-2026-102437CWE-78command-injection

CVE-2026-102437

High · published September 29, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00992 · 62.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-29T17:17Z
References (2)
https://github.com/esengine/DeepSeek-Reasonix · [email protected]https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-grg2-7gc6-36m6 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 1%
    epss
  • 29 SEP 12:06Z
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
    cvelistv5