Command Injection Vulnerability in DeepSeek-Reasonix by esengine

CVE-2026-102437

What is CVE-2026-102437?

CVE-2026-102437 is a command injection vulnerability identified in the DeepSeek-Reasonix application developed by Esengine. This software serves as a desktop app supporting various functionalities, most notably in the realm of content management via version control systems. The vulnerability originates from the internal handling of Git commands, specifically in the processing of configuration files used by Git. When an attacker possesses control over repository content, they may exploit this flaw to execute arbitrary operating system commands through the application's workspace changes diff viewer. The ability to inject commands could lead to unauthorized access and manipulation of the system, creating significant security risks for organizations utilizing this software.

Potential impact of CVE-2026-102437

1. Arbitrary Command Execution: The most critical impact of this vulnerability is that it enables local attackers to execute arbitrary commands on the host machine. This could lead to full system compromise, allowing attackers to perform actions such as data exfiltration, installation of malicious software, or complete takeover of the system.

2. Data Integrity Threats: Given that this vulnerability allows for the manipulation of command executions, attackers could alter or corrupt data managed by the DeepSeek-Reasonix application. This raises concerns regarding the integrity of repository content, affecting the reliability of essential organizational data and workflows.

3. Escalation of Privileges: Attackers exploiting this vulnerability may gain elevated privileges, potentially allowing them to access sensitive information or systems beyond the initial target. This could further facilitate advanced persistent threats (APTs), enabling attackers to deploy further exploits or distribute malware inside an organization's network.

References