Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-90946DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket

High 7.5

In plain English

A high-severity security flaw in deepwiki-open from AsyncFuncAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

Affected products (as reported)

Vendor	Product	Versions
AsyncFuncAI	deepwiki-open	0 – through d92819a

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #536 issue-tracking
https://github.com/AsyncFuncAI/deepwiki-open product
api/data_pipeline.py at 16f35a0 technical-description
api/repository.py at d92819a technical-description
VulnCheck Advisory: DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket third-party-advisory