CVE-2026-123653

A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.

• CWE-349

• https://github.com/esengine/DeepSeek-Reasonix/
• https://github.com/esengine/DeepSeek-Reasonix/commit/4ca33493a673c2788aa8598fbca2b2f47a69e1b8
• https://github.com/esengine/DeepSeek-Reasonix/issues/13061
• https://github.com/esengine/DeepSeek-Reasonix/releases/tag/v2.53.0
• https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-7v48-x992-r5w7
• https://github.com/ybyu-ieu/agent-security-advisories/blob/main/deepseek-reasonix/deepseek-reasonix-agents-md-prompt-injection-command-execution.md
• https://vuldb.com/cve/CVE-2026-123653
• https://vuldb.com/submit/1033134
• https://vuldb.com/vuln/431772
• https://vuldb.com/vuln/431772/cti

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12359IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…8.1
• CVE-2026-1236The Envira Gallery for WordPress plugin for WordPress is vul…6.4
• CVE-2026-12360The JetEngine plugin for WordPress is vulnerable to SQL inje…7.5
• CVE-2026-12363The LoRaWAN Fragmented Data Block Transport service (subsys/…4.2
• CVE-2026-12364The user-space system-call verifier z_vrfy_z_log_msg_static_…8.4
• CVE-2026-12365A use-after-free exists in the Zephyr second-generation work…5.8
• CVE-2026-123655A flaw was found in Moodle. Insufficient access control chec…7.5
• CVE-2026-12366Zephyr's dynamic kernel-object disposal path unref_check() i…8.8
• CVE-2026-123660In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1,…5.3
• CVE-2026-1237Vulnerable cross-model authorization in juju. If a charm's c…2.1
• CVE-2026-12370ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Netwo…7.6
• CVE-2026-12372A Server-Side Request Forgery (SSRF) vulnerability exists in…3.7