This vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78) within the gitcmd internal component of esengine DeepSeek-Reasonix. A local attacker with control over repository content can exploit the git diff filter.clean/smudge invocation mechanism to inject and execute arbitrary OS commands through the desktop app's diff viewer for workspace changes. The affected versions are all releases prior to 2.21.0. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows a local attacker to execute arbitrary OS commands with the privileges of the desktop application user. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The attack requires local access and control over repository content, but no privileges are required to initiate the attack beyond that. The high CVSS score reflects the significant potential impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and avoid using untrusted repository content in the affected versions. Monitor vendor channels for updates regarding patches or official mitigations.