CVE-2026-90946
highDeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as…
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/AsyncFuncAI/deepwiki-open disclosure@vulncheck.com
- https://github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0fc0284e99b7963bbf4e8585e9957e2fe1... disclosure@vulncheck.com
- https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89... disclosure@vulncheck.com
- https://github.com/AsyncFuncAI/deepwiki-open/issues/536 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-arbitrary-file-r... disclosure@vulncheck.com
- https://github.com/AsyncFuncAI/deepwiki-open/issues/536 134c704f-9b21-4f2e-91b3-4a467353bcc0