GHSA-wx44-2q6h-j6p8
Critical · 9.6CVSS
9.6
EPSS
—
Published
May 14, 2026
CISA due date
—
The record
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0.3.0 | 0.8.23 |
| crates.io | deepseek-tui-cli | 0.3.0 | 0.8.23 |
| npm | deepseek-tui | 0.3.0 | 0.8.23 |
Related vulnerabilities
- CVE-2026-45311 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Same vulnerability
- CVE-2026-45310 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45374 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45373 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- GHSA-72w5-pf8h-xfp4 DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project… Also affects deepseek-tui
- GHSA-88gh-2526-gfrr DeepSeek TUI has SSRF IPV6 bypass Also affects deepseek-tui
- GHSA-96ff-gc8g-wpvg DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool Also affects deepseek-tui
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94