The vulnerability is an OS Command Injection that occurs when Esengine DeepSeek-Reasonix processes repository configuration files during a git diff operation. By manipulating .gitattributes or .git/config, a local attacker can cause the application’s internal git command filter to execute arbitrary shell commands. This flaw enables full exploitation of the underlying operating system and effectively bypasses the application’s sandbox. The weakness is identified as CWE-78.

The flaw affects Esengine’s DeepSeek-Reasonix product, specifically the Reasonix Studio desktop application and the reasonix npm package. Versions prior to 2.21.0 of Reasonix Studio and prior to 1.39.3 of the npm package contain the vulnerable logic and are susceptible to exploitation.

The CVSS score of 7.8 indicates high severity, while the EPSS score is unavailable, leaving the likelihood of exploitation uncertain but potentially significant given the local access requirement. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet. The attack vector is local: an individual with access to the machine running Reasonix Studio can supply malicious repository content and trigger the injection via the workspace-changes diff viewer. Once triggered, the injected command runs with the privileges of the application, providing full control over the system.