CVE-2026-90946CWE-73

CVE-2026-90946

High · published September 14, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-09-14T22:20Z
References (6)
https://github.com/AsyncFuncAI/deepwiki-open · [email protected]https://github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0fc0284e99b7963bbf4e8585e9957e2fe1/api/data_pipeline.py · [email protected]https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/repository.py · [email protected]https://github.com/AsyncFuncAI/deepwiki-open/issues/536 · [email protected]https://www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-arbitrary-file-read-via-ws-chat-websocket · [email protected]https://github.com/AsyncFuncAI/deepwiki-open/issues/536 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 14 SEP 17:52Z
    DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
    cvelistv5