High severity7.5NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026
CVE-2026-90946
CVE-2026-90946
Description
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=d92819a
Patches
Vulnerability mechanics
References
4- github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0fc0284e99b7963bbf4e8585e9957e2fe1/api/data_pipeline.pynvd
- github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/repository.pynvd
- github.com/AsyncFuncAI/deepwiki-open/issues/536nvd
- www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-arbitrary-file-read-via-ws-chat-websocketnvd
News mentions
0No linked articles in our index yet.