Arbitrary File Read Vulnerability in DeepWiki-Open by AsyncFuncAI
CVE-2026-90946

8.7HIGH

Key Information:

Vendor

Asyncfuncai

Status
Deepwiki-open
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90946?

The DeepWiki-Open application, through a specific commit, exposes an arbitrary file read vulnerability via its unauthenticated WebSocket endpoint located at /ws/chat. This endpoint allows attackers to specify arbitrary file paths, granting access to sensitive files of various types, including Python, JavaScript, YAML, and JSON. Such exposure can reveal hardcoded secrets and credentials, leading to severe security implications for the affected system.

Affected Version(s)

deepwiki-open 0

References

https://github.com/AsyncFuncAI/deepwiki-open/issues/536
issue-tracking
https://github.com/AsyncFuncAI/deepwiki-open
product
https://github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.