GHSA-72w5-pf8h-xfp4
Critical · 9.6CVSS
9.6
EPSS
—
Published
May 14, 2026
CISA due date
—
The record
DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0 | 0.8.26 |
Related vulnerabilities
- CVE-2026-45374 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Same vulnerability
- CVE-2026-45310 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45311 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45373 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- GHSA-88gh-2526-gfrr DeepSeek TUI has SSRF IPV6 bypass Also affects deepseek-tui
- GHSA-wx44-2q6h-j6p8 DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval Also affects deepseek-tui
- GHSA-96ff-gc8g-wpvg DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool Also affects deepseek-tui
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94