CVE-2026-90946 AsyncFuncAI CVE debrief

Who should care

Defenders responsible for deploying and managing DeepWiki-Open instances should assess their exposure to this vulnerability. This includes reviewing network configurations, access controls, and file system permissions to prevent unauthorized access to sensitive information.

Why it matters

CVE-2026-90946 is a high-severity vulnerability in DeepWiki-Open that allows unauthenticated attackers to read arbitrary files, potentially exposing sensitive information. Defenders should prioritize verifying exposure and remediating vulnerable deployments.

• Potential exposure of hardcoded secrets and credentials in files that can be accessed through the vulnerable WebSocket endpoint.
• Possible unauthorized access to sensitive information stored in files with supported extensions.
• Need for verification of exposure and remediation of vulnerable deployments.
• Potential impact on confidentiality and integrity of sensitive data.

Technical summary

The DeepWiki-Open project contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint. This endpoint accepts a repo_url parameter as a filesystem path without proper containment, allowing attackers to supply arbitrary directory paths. This can be used to read all files with supported extensions, including Python, JavaScript, YAML, and JSON files, which may contain hardcoded secrets and credentials.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable deployments, especially in environments where secrets and credentials are stored in files that can be accessed by the affected WebSocket endpoint.

Recommended defensive actions

• Verify if your deployment of DeepWiki-Open is using the vulnerable WebSocket endpoint and if it has been exposed to untrusted network traffic.
• Check if your environment stores sensitive information in files that could be accessed through this vulnerability.
• Review and update access controls for the WebSocket endpoint to restrict access to trusted sources.
• Consider applying patches or updates provided by the vendor, if available.
• Perform a thorough review of file system permissions and network configurations to prevent unauthorized access to sensitive information.
• Monitor for suspicious activity related to the WebSocket endpoint and file access.
• Inventory assets that may be affected by this vulnerability and prioritize remediation efforts based on risk.

Evidence notes

The vulnerability is described in the CVE record and NVD entry, with additional details from source references, including GitHub repository and issue links. The CVE record was published on 2026-09-14T18:20:29.180Z and has not been modified since then. There are no known exploits or reports of this vulnerability being used in attacks. However, defenders should verify their exposure and remediate vulnerable deployments as a precaution. The DeepWiki-Open project has not provided patches or updates to address this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.