CriticalVulnerabilityLLM-specific
GHSA-wx44-2q6h-j6p8: DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
- Identifiers
- CVE-2026-45311GHSA-wx44-2q6h-j6p8
- Published
- Record updated
- Affected
- deepseek-tui >= 0.3.0, < 0.8.23
- deepseek-tui-cli >= 0.3.0, < 0.8.23
- Fixed in
- 0.8.23
- deepseek-tui 0.8.23 released May 8, 2026, 5 days before disclosure
- deepseek-tui-cli 0.8.23 released May 8, 2026, 5 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
The run_tests tool in DeepSeek TUI executes cargo test with ApprovalRequirement::Auto, so it runs without a user approval prompt. Because cargo test compiles and executes test binaries, build.rs scripts and proc macros, a malicious repository can run arbitrary shell commands with no approval, and the source states AGENTS.md can instruct the model to call run_tests at session start.
Mitigation
Change run_tests to require approval, matching exec_shell: fn approval_requirement(&self) -> ApprovalRequirement { ApprovalRequirement::Required }
Related items
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
- MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
- MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
- MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online