CVE-2026-123989

Reasonix repository builds can bypass Ask-mode approval

ESEngine · ESEngine DeepSeek-Reasonix

First documented disclosure · Review checkpoint

Summary

Repository builds can run host-side work outside Ask-mode approval.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Ask mode classified builds as read-only even though build scripts can execute, and certain repository status operations reached the host.

Conditions required

A user must work with an untrusted repository in an affected Reasonix setup. The published finding concerns local host permissions.

Potential impact

A repository can cause code to run as the user outside the expected approval boundary.

Affected versions and configurations

Through 1.33.0.

Fix and mitigation status

1.34.0.

Practical next steps

Update Reasonix to 1.34.0 and review trust settings for third-party repositories.

Operating lesson

Classify build and repository operations according to their actual host-side effects.

Evidence and limits

The August 29 maintainer fix explicitly names this finding. The October advisory explains the Ask-mode and host boundaries. VulDB published the CVE November 7.

Sources