CVE-2026-123653

Reasonix promotes repository memory into trusted agent instructions

esengine · DeepSeek Reasonix project memory

First documented disclosure · Review checkpoint

Summary

An untrusted repository can supply instructions that influence the agent’s shell actions.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The later advisory reports controlled tests. The earlier public issue says dynamic confirmation was pending. No malicious exploitation is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Project memory files load automatically and are labelled as trusted user guidance before a workspace trust decision.

Conditions required

The victim starts Reasonix in a hostile repository. The resulting impact depends on available tools, shell permissions and network controls.

Potential impact

The published advisory reports controlled shell invocation and a benign marker file. Data theft and persistence are potential outcomes, not observed victims.

Affected versions and configurations

VulDB lists releases through 2.52.0. Research tested 1.17.8; the maintainer says 1.x is no longer maintained.

Fix and mitigation status

2.53.0 adds a mitigation: untrusted instructions are labelled unverified and project system_prompt_file is ignored until trust is granted.

Practical next steps

Migrate from 1.x to a supported 2.x release containing the mitigation; keep untrusted workspaces restricted and require approval for sensitive tool actions.

Operating lesson

Opening a repository should not silently grant its documents instruction authority.

Evidence and limits

October 14 is public disclosure, October 27 the detailed advisory and release, and November 6 CNA publication. The maintainer explicitly says the mitigation reduces exposure and does not make repository prompt injection impossible. VulDB’s 5.3 CVSS 4.0 differs from the researcher’s proposed 9.6 CVSS 3.1.

Sources