{"data":{"id":"bddf586a-c17e-416d-9ebc-cc234c620f62","title":"GHSA-72w5-pf8h-xfp4: DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files","summary":"The task_create tool in DeepSeek TUI spawns durable sub-agents that default to allow_shell=true (config.rs:1499) and auto_approve=true (task_manager.rs:297). A user who approves a benign-looking task_create call therefore unknowingly grants the sub-agent unapproved shell access, which can follow attacker-controlled instructions in a cloned repository's AGENTS.md file and run commands without a further approval prompt. The reporter demonstrates remote code execution through a proof of concept that triggers a callback to a collaborator server.","solution":"Default allow_shell to false for durable tasks (config.rs:1499: self.allow_shell.unwrap_or(false)); default auto_approve to false for durable tasks (task_manager.rs:297: auto_approve: None, instead of Some(true)); and, when the model requests task_create with allow_shell=true, surface that in the approval prompt so the user knows they are granting shell access.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-72w5-pf8h-xfp4","publishedAt":"2026-05-14T20:29:52.000Z","cveId":"CVE-2026-45374","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["deepseek-tui@< 0.8.26 (fixed: 0.8.26)"],"affectedPackageNames":["deepseek-tui"],"affectedPackageRefs":["cargo:deepseek-tui"],"affectedVendors":[],"affectedVendorsRaw":["DeepSeek TUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00387,"epssCheckedAt":"2026-11-07T12:08:47.755Z","kevDateAdded":null,"advisoryAliases":["GHSA-72w5-pf8h-xfp4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T20:29:52.000Z","fixReleasedAt":"2026-05-10T07:49:49.376Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:36:02.209Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"cargo","name":"deepseek-tui","fixedVersion":"0.8.26","matchedVersion":"0.8.26","fixReleasedAt":"2026-05-10T07:49:49.376Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:36:02.060Z"}]}}