Image: res.cloudinary.com · rights & removal

DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent

Reporting by GitLab BlogRead the original at about.gitlab.com

Executive Summary

A command execution vulnerability named ConfigPoisoning was discovered in DeepSeek-Reasonix Studio, a desktop git client used for AI-assisted development. This flaw allowed attacker-supplied code to execute when a developer viewed a file's diff under specific repository configuration conditions. The root cause stems from a gap in how the tool handled certain git configuration keys, specifically filter..clean, which was not protected by existing hardening measures implemented within DeepSeek-Reasonix's wrapper code. This vulnerability is not isolated to DeepSeek-Reasonix; GitLab's Threat Research Group found that multiple coding agents are susceptible to similar vulnerabilities originating from attacker-controlled files like .git/config and .gitattributes. The exploit vector involves a compromised agent accessing the developer's filesystem, which contains repository configuration data, to inject malicious commands executed via git operations during diff rendering. Immediate remediation involves updating to DeepSeek-Reasonix Studio 2.21.0 or npm 1.39.3, and for broader tooling, ensuring that tools shelling out to git neutralize all relevant repository configuration keys when operating against untrusted directories.

Facts Only

* A command execution vulnerability named ConfigPoisoning was found in DeepSeek-Reasonix Studio, a desktop git client.
* The vulnerability has the identifier GHSA-grg2-7gc6-36m6 and CVE-2026-102437.
* The flaw allows attacker-supplied code to execute when viewing a file's diff under specific repository configuration conditions.
* The root cause is a gap in DeepSeek-Reasonix's git wrapper regarding the filter..clean key, which git selects per file via .gitattributes.
* GitLab's Threat Research Group found multiple coding agents are susceptible to similar vulnerabilities involving attacker-controlled commands from .git/config and .gitattributes files.
* The vulnerability affects both the desktop application and the npm package.
* The exploit does not require an archive or synced folder, potentially being delivered directly through a compromised coding agent accessing local filesystem access.
* Immediate recommendations include updating to DeepSeek-Reasonix Studio 2.21.0 or npm 1.39.3.
* Tools shelling out to git should override all relevant configuration keys or avoid using git's filter and textconv machinery.

Full Take

The situation reveals a systemic vulnerability where the trust model inherent in agentic tooling, which relies on inheriting repository-local configuration files like .git/config and .gitattributes, creates an exploitable path for command injection when those configurations are not exhaustively neutralized by the wrapper. The failure points to an incomplete hardening strategy: while the tool closed several primitive keys, it missed a mechanism—filter..clean—which remains susceptible to being manipulated via file-specific attributes (.gitattributes). This suggests that security in agentic environments is often defined by the intersection of what the application explicitly secures and what the underlying system permits. The pattern observed is one of cascading trust: a remote actor compromises an agent, which then leverages the local context (the repository's configuration) to execute operations against the host system via git. This implies that security enforcement must shift from securing the communication channel to strictly controlling the execution context provided by the shell itself. The implication for human agency is that relying on automated tools to manage complex operations introduces new, hidden attack surfaces based on subtle omissions in abstraction layers. What mechanisms are needed to ensure that local configuration files cannot be used as dynamic command injection points, regardless of which layer—desktop application or agent—is executing the git commands? What oversight exists for ensuring that security fixes are applied not just to obvious input vectors but to those obscure internal dependencies of underlying utilities like git?

From the original · GitLab Blog

Published on: October 2, 2026 7 min read GitLab's Threat Research Group found a flaw, ConfigPoisoning, that runs attacker code when a developer views a file's diff in DeepSeek-Reasonix.

Read the full story at about.gitlab.com

Sentinel — provisional

Raw score, 0 to 1 (uncalibrated)0.20

No strong signs of machine writing were found in the source article. Provisional estimate, not a finding that a person wrote it.

The model's own note (unverified)

The text reads like a detailed security advisory written by an expert but is highly structured, suggesting it was either written by a human subject matter expert or meticulously prompted to mimic that style.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.

What the model noticed in the source article

Moderate sentence length variance and complex structural explanation suggesting human drafting.

High internal coherence; the argument flows logically from specific bug discovery to general implications, typical of deep technical analysis.

Structured presentation with clear cause-and-effect chain and specific references (CVEs, file paths); this points toward structured human reporting or careful LLM prompting.

Specific, low-level technical details regarding git configuration keys, code path analysis ('desktop/workspace_changes.go'), and vulnerability naming suggest high specificity, but the overall tone is journalistic disclosure.

Signs the model read as against machine writing

Use of highly specific, nested technical chains (e.g., chain involving .gitattributes, filter commands, and path logic) that require deep domain expertise to construct coherently.

The inclusion of a narrative reflection about the maintainers' process ('knowing about a risk and closing it aren't always the same thing') provides a nuanced, non-purely technical insight often found in human commentary.

The inclusion of forward-looking advice for other tools and agents suggests an author operating within a larger ecosystem context.