Multiple high and critical vulnerabilities have been identified in CodeWhale/DeepSeek-TUI, affecting AI-agent tools that handle file access, shell execution, Git operations, JavaScript/Python execution, and outbound network requests. The advisory contains 9 CVEs, including an SSRF bypass rated CVSS 8.6 and multiple vulnerabilities that can enable arbitrary code execution, arbitrary file access, or credential exposure.
CVE-2026-75914 (CVSS 7.5): A high-severity path traversal/symlink-following vulnerability in the image_analyze tool allows files outside the workspace to be read through malicious workspace symlinks. The tool can automatically send the contents to the configured vision endpoint without an approval prompt, potentially exposing sensitive files.[/subscribe_to_unlock_form]
Multiple high and critical vulnerabilities have been identified in CodeWhale/DeepSeek-TUI, affecting AI-agent tools that handle file access, shell execution, Git operations, JavaScript/Python execution, and outbound network requests. The advisory contains 9 CVEs, including an SSRF bypass rated CVSS 8.6 and multiple vulnerabilities that can enable arbitrary code execution, arbitrary file access, or credential exposure.
CVE-2026-75914 (CVSS 7.5): A high-severity path traversal/symlink-following vulnerability in the image_analyze tool allows files outside the workspace to be read through malicious workspace symlinks. The tool can automatically send the contents to the configured vision endpoint without an approval prompt, potentially exposing sensitive files.[emaillocker id="1283"]
CVE-2026-75859 (CVSS 7.5): A high-severity arbitrary file read vulnerability allows a malicious repository configuration to override the instructions setting with arbitrary filesystem paths. Sensitive files such as SSH keys, cloud credentials, and environment files can be read and injected into the AI model's system prompt, creating an exfiltration path.
CVE-2026-75857 (CVSS 7.0): A high-severity privilege-management vulnerability exists in exec_shell_interact. After a user approves an interactive shell, model-controlled input can subsequently be sent to that process without another approval prompt. This can allow commands to execute with the privileges of the already-approved process, including potentially privileged shells.
CVE-2026-75913 (CVSS 9.3): A high-severity argument injection vulnerability in the git_show tool allows a model-controlled rev parameter to be interpreted as a Git command-line option such as --output=<path>. Because the tool is automatically approved, an attacker-controlled repository combined with prompt injection can cause arbitrary files owned by the user to be overwritten without an approval prompt.
CVE-2026-75915 (CVSS 7.5): A high-severity information disclosure vulnerability in js_execution allows model-provided JavaScript to inherit the parent process environment. This can expose API keys, cloud credentials, source-control tokens, and other sensitive environment variables to the AI model.
CVE-2026-75856 (CVSS 8.6): A critical SSRF vulnerability allows attackers to bypass DNS-pinning protections through a time-of-check/time-of-use condition. By causing DNS resolution to fail during the initial validation and then resolving the same hostname to an internal address during the subsequent request, an attacker can bypass SSRF restrictions and access internal services, private networks, or cloud metadata.
CVE-2026-75912 (CVSS 7.4): A high-severity argument injection vulnerability in the git_blame tool allows attacker-controlled Git arguments to be abused for arbitrary file reads without an approval prompt. This can expose sensitive files accessible to the user running the AI agent.
CVE-2026-75858 (CVSS 7.8): A high-severity remote code execution vulnerability exists in the rlm_eval tool because arbitrary Python code selected by the model is automatically approved and executed without respecting the configured approval policy. Prompt injection from untrusted repositories, web content, or MCP responses can therefore cause code execution with the user's privileges.
CVE-2026-75911 (CVSS 7.8): A high-severity code execution vulnerability allows a malicious .codewhale/config.toml or .deepseek/config.toml file in a cloned repository to silently enable allow_shell = true. This can activate the AI agent's shell-execution capability without the user's explicit opt-in, potentially resulting in arbitrary shell command execution on the victim's system.
The following reports contain further technical details:
[/emaillocker]