CVE-2026-75913: DeepSeek TUI — CRITICAL

Q: Is CVE-2026-75913 actively exploited?

No confirmed active exploitation of CVE-2026-75913 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-75913?

Update to patched version: DeepSeek TUI 0.8.64, DeepSeek TUI 0.8.64, DeepSeek TUI 0.8.41.

Q: What is the CVSS score for CVE-2026-75913?

CVE-2026-75913 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.33%.

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
DeepSeek TUI	npm	>= 0.8.41, < 0.8.64	`0.8.64`
DeepSeek TUI	cargo	>= 0.8.41, < 0.8.64	`0.8.64`
DeepSeek TUI	npm	>= 0.3.27, < 0.8.41	`0.8.41`
DeepSeek TUI	cargo	>= 0.3.27, <= 0.8.41	No patch

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C None

I High

A High

What should I do?

Patch available

Update DeepSeek TUI to version 0.8.64

Update DeepSeek TUI to version 0.8.41

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-75913?

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.

Is CVE-2026-75913 actively exploited?

No confirmed active exploitation of CVE-2026-75913 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75913?

Update to patched version: DeepSeek TUI 0.8.64, DeepSeek TUI 0.8.64, DeepSeek TUI 0.8.41.

What is the CVSS score for CVE-2026-75913?

CVE-2026-75913 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.33%.

What are the technical details?

Original Advisory

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path Primary CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.