Description

A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-11-06T14:17:10.923Z",
  "pubdate": "2026-11-06T14:17:10.923Z",
  "executiveSummary": "A critical security vulnerability has been identified in esengine DeepSeek-Reasonix versions up to 2.52.0, specifically stemming from the improper neutralization of user-supplied input used for Large Language Model (LLM) prompting.\nThe vulnerability resides within the discoverDocs function in internal/memory/doc.go. This flaw allows remote attackers to manipulate LLM prompt structures, potentially leading to unauthorized data exposure, prompt injection, or system control.\nGiven that the exploit has been disclosed publicly, the risk of active exploitation is significant. The vulnerability allows for remote execution without the need for prior authentication, necessitating an immediate transition to version 2.53.0 to mitigate the threat landscape effectively.\nImpacts include the subversion of internal logic via prompt injection and the potential compromise of downstream LLM outputs. Organizations utilizing affected versions are strongly advised to prioritize the application of the official patch identified by 4ca33493a673c2788aa8598fbca2b2f47a69e1b8.",
  "technicalDetails": "The vulnerability is localized to the discoverDocs function located within internal/memory/doc.go of the esengine DeepSeek-Reasonix codebase. The root cause is categorized as an improper neutralization of input used for LLM prompting, often referred to as prompt injection.\nIn the context of the discoverDocs function, the application fails to adequately sanitize or validate data inputs before they are concatenated into the prompt construction pipeline destined for the LLM. Because the system processes these inputs as trusted instructions rather than literal data, an attacker can supply specially crafted payloads that break out of the intended operational context.\nThe attack flow initiates remotely, where an adversary provides malicious input strings that are subsequently processed by discoverDocs. By leveraging prompt injection techniques, the attacker can force the LLM to deviate from its system-defined instructions. This might involve overriding security boundaries, leaking sensitive information contained within the system's document memory, or manipulating the reasoning output generated by the DeepSeek-Reasonix engine.\nThe exploit does not require authentication, as the vulnerable endpoint is accessible via remote network requests. Upon processing the malicious input, the LLM consumes the injected instructions as part of its prompt context. The post-exploitation impact allows for 'jailbreaking' the model's behavior, where the attacker can effectively control the LLM's decision-making process or force it to ignore established usage constraints. Because the payload behavior is executed by the model's reasoning engine, this vulnerability can lead to critical failures in input validation logic throughout the memory management system. The inclusion of malicious delimiters or control sequences within the discoverDocs input stream allows for complex state manipulation of the model's environment.\nAffected versions include all iterations of DeepSeek-Reasonix up to and including 2.52.0. The remediation via patch 4ca33493a673c2788aa8598fbca2b2f47a69e1b8 introduces necessary filtering and structural sanitization within the internal/memory/doc.go component, ensuring that user-provided inputs are strictly delimited or neutralized to prevent logic-altering prompt injections."
}