CVE-2026-102437: viewing a diff in DeepSeek-Reasonix Studio could run a git filter from a poisoned repo

Vulnerability · DeepSeek-Reasonix (Reasonix Studio) · HIGH

Incident dateNot stated

DisclosedSep 30, 2026 (GitHub advisory GHSA-grg2-7gc6-36m6 and fix). NVD published Sep 29, 2026. GitLab public write-up Oct 2, 2026. Added here as a backfill on Oct 15, 2026.

Added hereOct 15, 11:25 AM ET

Last verifiedOct 15, 2026

Summary

GitLab's Threat Research Group disclosed ConfigPoisoning in DeepSeek-Reasonix Studio, a desktop git client and coding agent for AI-assisted development. The app's git wrapper blocked several dangerous config keys, but left filter.*.clean alone. An attacker who could place a .gitattributes entry and a matching filter.*.clean command in .git/config could run that command when a developer opened a file's diff in the workspace-changes view. GitLab rates it CVSS 3.1 7.8 High (GHSA-grg2-7gc6-36m6, CVE-2026-102437). The maintainers fixed it in Studio 2.21.0 and npm reasonix 1.39.3 on Sep 30, 2026. This is a backfill of a fixed issue.

Severity

HIGH Code execution on a developer machine from opening a diff. Needs a poisoned local .git/config (archives, synced folders, CI caches, or another agent writing it) plus the victim viewing the diff. Fixed in Studio 2.21.0 / npm 1.39.3. No in-the-wild exploitation is reported.

Timeline

Aug 27, 2026
GitLab opens the advisory with esengine (per GitLab's disclosure timeline).
Sep 29, 2026
esengine accepts the report and opens a temporary private fork.
Sep 30, 2026
Fix ships in Studio 2.21.0 and npm reasonix 1.39.3; GitHub advisory GHSA-grg2-7gc6-36m6 is published; CVE-2026-102437 is assigned.
Sep 29, 2026
NVD publishes CVE-2026-102437 (record timestamp).
Oct 2, 2026
GitLab publishes its public write-up on ConfigPoisoning.

How it happened

DeepSeek-Reasonix's internal/gitcmd wrapper clears core.fsmonitor and maintenance.auto on every call and adds --no-ext-diff and --no-textconv on diffs, but it never overrides filter.*.clean. That filter is selected per file through .gitattributes, so a deny-list of fixed keys does not catch it. When the desktop app builds a workspace diff, git still runs the clean filter to produce the comparison blob, and the attacker's command runs once per side of the diff. .gitattributes survives a normal clone; .git/config does not, so delivery needs an archive, synced folder, CI cache, or another process that can write .git/config on the machine. GitLab notes the same class of trust failure can appear in other coding agents that shell out to git.

How to check your app

Update DeepSeek-Reasonix Studio to 2.21.0 or later, or npm reasonix to 1.39.3 or later (current npm latest is well past that).
On older versions, avoid opening diffs in repositories you did not obtain through a direct clone yourself.
If you build tools that shell out to git, override filter.*.clean and related keys on every call, or read blobs without invoking git's filter machinery.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.