Executive brief
DeepSeek TUI is a terminal-based interface for interacting with AI models. A vulnerability exists where the tool can be tricked into running malicious code automatically when a user opens a specially crafted project repository. This could allow an attacker to steal sensitive data, access credentials, or take control of the user's computer without any warning or approval prompts.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the `run_tests` tool of DeepSeek TUI. The tool was designed to execute `cargo test` with `ApprovalRequirement::Auto`, bypassing the standard user confirmation gate used for other shell commands. An attacker can exploit this by placing malicious code in Rust test files, build scripts, or procedural macros within a repository. Furthermore, by using a specially crafted `AGENTS.md` file, an attacker can use prompt injection to instruct the AI model to automatically trigger the `run_tests` tool upon session start. This results in arbitrary code execution with the privileges of the user running the TUI. The issue is fixed in version 0.8.23 by requiring manual approval for test execution.
Affected products
- Hmbown/CodeWhale deepseek-tui >= 0.3.0, < 0.8.23
- Hmbown/CodeWhale deepseek-tui-cli >= 0.3.0, < 0.8.23
Timeline
- 2026-05-09: disclosed
- 2026-05-14: advisory: GHSA-wx44-2q6h-j6p8 published
- 2026-05-14: patched: Version 0.8.23 released