Read the docs
TI-2026-86619 Aliases CVE-2026-123989GHSA-vcfm-54ff-823x

ESEngine DeepSeek-Reasonix build.rs loadGitStatus permission issue

Priority LOW 39CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

A vulnerability in ESEngine DeepSeek-Reasonix up to 1.33.0 affects the loadGitStatus function in build.rs, part of the Build Script Execution component. Manipulation leads to permission issues classified as CWE-266 (Incorrect Privilege Assignment). The attack can be started remotely. The CVSS 4.0 base score is 5.3 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.

Why it matters now

Fix Fixed DeepSeek-Reasonix (ESEngine): 1.34.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
esengineDeepSeek-Reasonix1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28; 1.29; 1.30; 1.31; 1.32; 1.33.01.34.0Patch availableCNA
  • DeepSeek-Reasonix Vendoresengine Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28; 1.29; 1.30; 1.31; 1.32; 1.33.0 Fixed in 1.34.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:esengine:deepseek-reasonix:*:*:*:*:*:*:*:*——esengine
  • cpe:2.3:a:esengine:deepseek-reasonix:*:*:*:*:*:*:*:* Versions — — ·esengine

Remediation

Upgrade the affected component to version 1.34.0, which contains the fix named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA DeepSeek-Reasonix (ESEngine) Fixed in 1.34.0

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-123989
  2. 2026-11-07 Alias added: GHSA-vcfm-54ff-823x

References

Patch 3

Other 2

  • TI-2026-65396 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix CVSS 3.1HIGH 7.8
  • TI-2026-85916 Prompt injection in esengine DeepSeek-Reasonix document discovery CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences