High severity · published Sep 14, 2026
CVE-2026-90946
DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
deepwiki-open · AsyncFuncAI
through d92819a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90946
github.com
https://github.com/AsyncFuncAI/deepwiki-open
github.com
https://github.com/AsyncFuncAI/deepwiki-open/blob/16f35a0fc0284e99b7963bbf4e8585e9957e2fe1/api/data_pipeline.py
github.com
https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/repository.py
github.com
https://github.com/AsyncFuncAI/deepwiki-open/issues/536
www.vulncheck.com
https://www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-arbitrary-file-read-via-ws-chat-websocket
More from deepwiki-open
9.8
CVE-2026-72567
deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
7.5
CVE-2026-103591
DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file
7.5
CVE-2026-72602
AsyncFuncAI deepwiki-open - Path Traversal