What’s Vulnerable › Vulnerabilities

CVE-2026-90946: DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-73

Description

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

References

• https://github.com/AsyncFuncAI/deepwiki-open
• https://github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0fc0284e99b7963bbf4e8585e9957e2fe1/api/data_pipeline.py
• https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/repository.py
• https://github.com/AsyncFuncAI/deepwiki-open/issues/536
• https://www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-arbitrary-file-read-via-ws-chat-websocket
• https://github.com/AsyncFuncAI/deepwiki-open/issues/536

Get alerted when CVE-2026-90946 or the next vulnerability affects your stack