Skip to content

Translation in progress Some entries still include text in the original language.

EventPast event

DeepSeek-Reasonix 客户端 git 配置注入致命令执行漏洞

1 reports1 reporting sources

Start here

AI overview

GitLab 威胁研究团队披露 DeepSeek-Reasonix Studio 存在命令执行漏洞 ConfigPoisoning（CVE-2026-102437）：攻击者可通过仓库的 .git/config 与 .gitattributes 文件，在开发者查看文件 diff 时执行任意代码。根因是 DeepSeek-Reasonix 的 git 封装虽加固了 core.fsmonitor、maintenance.auto 等键，但仍存在可被利用的配置注入面。

Generated by AI from reports · Updated 3 days ago

Progress timeline

Date not provided
  1. Date not given
    about.gitlab.comSelected
    GitLab discloses DeepSeek-Reasonix Studio configuration poisoning vulnerability that can hijack AI coding agents

    GitLab 威胁研究团队在 DeepSeek-Reasonix Studio 中发现命令执行漏洞 ConfigPoisoning（CVE-2026-102437），攻击者可通过仓库的 .git/config 与 .gitattributes 文件在开发者查看文件 diff 时执行任意代码。根因是 DeepSeek-Reasonix 的 git 封装加固了 core.fsmonitor、maintenance.auto 等键并加上 --no-ext-diff、--no-textconv，但未处理由 .gitattributes 按文件选择的 filter.<driver>.clean，该过滤器在生成 diff 比较 blob 时仍会运行，且每侧各触发一次。修复版本为 DeepSeek-Reasonix Studio 2.21.0 或 npm 1.39.3，影响桌面应用与 npm 包。

Related discussion

No discussion links have been collected for this event yet.

Attention trend

New sources per day

8 days total1 ·Maximum1（Oct 5）·Today0

  • Oct 5New1 sources (1 outlets,0 accounts)
  • Oct 6New0 sources (0 outlets,0 accounts)
  • Oct 7New0 sources (0 outlets,0 accounts)
  • Oct 8New0 sources (0 outlets,0 accounts)
  • Oct 9New0 sources (0 outlets,0 accounts)
  • Oct 10New0 sources (0 outlets,0 accounts)
  • Oct 11New0 sources (0 outlets,0 accounts)
  • Oct 12New0 sources (0 outlets,0 accounts)

Hourly attention

No comparable trend data