Privilege escalation in Esengine Deepseek-Reasonix
CVE-2026-123989
A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file build.rs of the component Build Script Execution. Performing a manipulation results in permission issues. The attack may be initiated remotely. Upgrading to version 1.34.0 is recommended to address this issue. The patch is named a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf. You should upgrade the affected component.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Esengine Deepseek-Reasonix — versions 1.0, 1.1, 1.10
Weakness classification (CWE)
References
- github.com/esengine/DeepSeek-Reasonix/ (product)
- github.com/esengine/DeepSeek-Reasonix/commit/a54659c2c5b0f4e57aae2b44d41f421c6a… (patch)
- github.com/esengine/DeepSeek-Reasonix/pull/9599 (issue-tracking, patch)
- github.com/esengine/DeepSeek-Reasonix/releases/tag/desktop-v1.34.0 (patch)
- github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-6qf8-c4r6-q4qq (related)
- CVE-2026-123989 | CVE Analysis and Report (third-party-advisory)
- Submit #1035343 | ESEngine Reasonix ≤v1.18.0 Permission Bypass (third-party-advisory)
- VDB-432064 | ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission (technical-description, vdb-entry)
- VDB-432064 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-123989?
- CVE-2026-123989 is a medium-severity vulnerability in Esengine Deepseek-Reasonix, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-11-07.
- How severe is CVE-2026-123989?
- Medium severity. CVSS v3 base score is 6.3 out of 10.