DNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic.
The rlm_eval tool runs an arbitrary Python string chosen by the model in a real python3 interpreter. Its approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as "never prompt," regardless of the user's configured –approval-policy. A single tool call — which prompt injection from any untrusted content the agent reads (a web page, a fetched URL, a repo file, an MCP tool result) can induce — runs code on the user's …
A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can set instructions to an array of arbitrary file paths (including paths outside the workspace like ~/.ssh/id_rsa or ~/.aws/credentials) that are read from disk and injected into the AI model's system prompt. There is no path validation, workspace boundary check, or tightening guard on the instructions field. This enables a malicious repository to exfiltrate the contents of sensitive files on the …
A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can silently set allow_shell = true for any user who clones and opens the repository in CodeWhale. This enables the AI model's exec_shell tool, granting arbitrary shell command execution on the victim's machine without the user's explicit opt-in. The approval_policy and sandbox_mode fields correctly enforce tightening-only semantics from project config, but allow_shell has no such guard, contradicting the intent of GHSA-72w5-pf8h-xfp4 …
js_execution exposes parent process environment to model-provided JavaScript The js_execution tool spawns Node with tokio::process::Command::new without calling the child_env scrubber that exec_shell, the Python REPL, and the MCP launcher all use. Model-provided JavaScript reads process.env and the values flow back to the parent transcript as the tool's stdout, exposing API keys, cloud credentials, and forge tokens to the next model turn.
image_analyze follows workspace symlinks and leaks outside-workspace file bytes to the vision endpoint The image_analyze tool resolves its image_path with a bare context.workspace.join instead of routing through ToolContext::resolve_path. The pre-join lexical check rejects absolute paths, Windows prefixes, and parent-dir components but never canonicalizes, so a symlink inside the workspace whose name ends in an image extension and whose target sits outside the workspace is read transparently. The tool has ReadOnly …
exec_shell is correctly approval-gated. Its sibling exec_shell_interact returns ApprovalRequirement::Auto, so when the model writes input into a shell the user already approved (a python3 -i REPL, mysql, ssh, sudo -i, etc.), no prompt fires. Inside those processes, "stdin" is the command surface, so the model gets to run commands at whatever privilege that process holds. The user approved opening the shell once, for a stated purpose; the input that then …
A malicious repository combined with prompt injection, the threat model already documented in CVE-2026-45311 (auto-loaded AGENTS.md is treated as instructions by the model) yields an unprompted arbitrary file write at the privilege of the user running DeepSeek-TUI. Useful targets reachable as the invoking user: ~/.ssh/authorized_keys ~/.bashrc, ~/.zshrc, ~/.profile ~/.gitconfig (chainable into RCE via core.editor) ~/.config/**, ~/.aws/credentials, project source files The written content is the git show rendering of HEAD commit …
Arbitrary file read at the privilege of the user running DeepSeek-TUI, via malicious repository content combined with prompt injection (the threat model already documented in CVE-2026-45311). Reachable as the invoking user: ~/.ssh/id_rsa, ~/.ssh/id_ed25519, and other private keys ~/.aws/credentials, ~/.config/gh/hosts.yml, ~/.netrc .env files anywhere in the filesystem Any project file outside the workspace the tool would normally restrict to The leaked contents land in the model's context. The same model that …