GHSA-72w5-pf8h-xfp4: DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

Summary

The task_create tool in DeepSeek TUI spawns durable sub-agents that default to allow_shell=true (config.rs:1499) and auto_approve=true (task_manager.rs:297). A user who approves a benign-looking task_create call therefore unknowingly grants the sub-agent unapproved shell access, which can follow attacker-controlled instructions in a cloned repository's AGENTS.md file and run commands without a further approval prompt. The reporter demonstrates remote code execution through a proof of concept that triggers a callback to a collaborator server.

Mitigation

Default allow_shell to false for durable tasks (config.rs:1499: self.allow_shell.unwrap_or(false)); default auto_approve to false for durable tasks (task_manager.rs:297: auto_approve: None, instead of Some(true)); and, when the model requests task_create with allow_shell=true, surface that in the approval prompt so the user knows they are granting shell access.

Topics

• Prompt injection and jailbreaks

Related items

• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News