CVE-2026-102437 (ConfigPoisoning): Viewing a Diff in DeepSeek-Reasonix Studio Ran the Repository's git filter.clean Command

GitLab's Threat Research Group (Abisheik Magesh, Daniel Abeles) published ConfigPoisoning on 2 October 2026. It is tracked as GHSA-grg2-7gc6-36m6, published by the maintainer on 29 September and rated critical, and as CVE-2026-102437, with GitLab as CNA and a CVSS 3.1 score of 7.8. DeepSeek-Reasonix's internal/gitcmd wrapper neutralized core.fsmonitor and maintenance.auto and passed --no-ext-diff and --no-textconv, but did nothing about filter.<driver>.clean, which .gitattributes selects per file; a comment in its own code named that gap. When a developer opened a file's diff in the Reasonix Studio desktop app, git ran the clean filter defined in the repository's .git/config to build the comparison blob, so the attacker's command ran once for each side of the diff. .gitattributes survives a clone but .git/config does not, so delivery needs an archive, a synced folder, a CI cache or a devcontainer build, or another compromised or prompt-injected agent on the machine writing the config into a normally cloned repository. Fixed in Reasonix Studio 2.21.0 and the reasonix npm package 1.39.3 on 30 September. GitLab says several other widely used coding agents have the same class of flaw and are under coordinated disclosure.

You are affected if you run reasonix <1.39.3. Versions 2.21.0 and later include the fix.

Upgrade Reasonix Studio to 2.21.0 and the reasonix npm package to 1.39.3 or later. On older versions, do not open diffs in repositories that did not come from your own direct clone. Check .git/config in local repositories for filter.*.clean or smudge, diff.external, core.hooksPath, core.fsmonitor and core.sshCommand entries nobody set, especially in repositories extracted from archives or shared folders. Tools that run git against directories they do not control should override every command-running key on each call, or read blobs with git cat-file instead.