AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-72w5-pf8h-xfp4: DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

criticalvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseMay 14, 2026CVE-2026-45374

Summary

DeepSeek TUI has a security flaw where the `task_create` tool (which spawns sub-agents that perform work independently) defaults to allowing shell access (`allow_shell=true`) and auto-approving commands (`auto_approve=true`) without explicit user permission. An attacker can hide malicious instructions in project files, and when a user approves what looks like a simple task (like 'fix TODOs'), the spawned sub-agent silently executes the attacker's shell commands with no additional approval prompt.

Solution / Mitigation

The source text provides explicit mitigations: (1) Change `config.rs:1499` to default `allow_shell` to `false` instead of `true` by replacing `self.allow_shell.unwrap_or(true)` with `self.allow_shell.unwrap_or(false)`. (2) Change `task_manager.rs:297` to default `auto_approve` to `None` instead of `Some(true)`, so it does not inherit the session setting. (3) When the model requests `task_create` with `allow_shell=true`, display that fact in the approval prompt so the user knows they are granting shell access.