DEEPSEEK-REASONIX: HOW A POISONED CONFIG CAN HIJACK AN AI CODING AGENT

Summary from the TLDR InfoSec newsletter

ConfigPoisoning (CVE-2026-102437) ran attacker commands when a developer viewed a file diff in DeepSeek-Reasonix Studio, because a .gitattributes entry pointed the file at a command in a poisoned .git/config that the tool's hardened git wrapper never overrode. Since .git/config does not survive a clone, delivery needed an archive, synced folder, or CI cache, or a prompt-injected agent writing it into an already-cloned repo, and GitLab reports the same flaw class in several other coding agents under coordinated disclosure. Users should update to Studio 2.21.0 or npm 1.39.3, and builders of git-wrapping tools should override every command-executing config key on each call or read blobs with git cat-file and diff in-process.