CVE-2026-90946

DeepWiki-Open, an open-source self-hosted code-wiki generator maintained by AsyncFuncAI, contains an arbitrary file read vulnerability (CWE-73) in its unauthenticated /ws/chat WebSocket endpoint through commit d92819a. The endpoint accepts a repo_url parameter that is treated as a filesystem path with no directory containment, so a remote attacker with no credentials can connect to the WebSocket and supply any directory path on the server. The application then ingests and returns the contents of all files in that path with supported extensions, including Python, JavaScript, YAML, and JSON files, which frequently contain hardcoded secrets, API keys, and credentials. Any self-hosted DeepWiki-Open instance running code up to and including commit d92819a that exposes the WebSocket endpoint is affected. There is no known public PoC, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported as of this analysis.

What to do: Upgrade immediately to a build newer than commit d92819a that enforces path containment on repo_url, and place the /ws/chat WebSocket endpoint behind authentication or an authenticated reverse proxy rather than exposing it publicly. Restrict the service's filesystem access (e.g., containerization with read-only mounts outside the intended repositories directory) to limit what any file-read primitive can reach. Finally, audit server logs for /ws/chat requests with repo_url values pointing to local directories outside expected repositories, and rotate any API keys, tokens, or credentials stored in .py, .js, .yaml, or . files on the host.