Is deepseek-tui safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-gx45-xrj5-g6c4 · 2026-09-04CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
• VulnerabilityGHSA-wrj3-vj8c-784f · 2026-09-04CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
• VulnerabilityGHSA-c6mw-8xh8-gpq6 · 2026-09-04CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
• VulnerabilityGHSA-6v2g-fpxh-pmmh · 2026-09-04CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning
• VulnerabilityGHSA-h539-c7r8-3xq4 · 2026-09-04CodeWhale: js_execution leaks parent environment to model context via missing env scrub
• VulnerabilityGHSA-7j5w-7r7x-9v27 · 2026-09-04CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
• VulnerabilityGHSA-g29h-pfmp-qp9r · 2026-09-04CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
• VulnerabilityGHSA-62f5-cp2p-vq95 · 2026-09-04CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
• VulnerabilityGHSA-w7wx-5q49-r59w · 2026-09-04CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
• VulnerabilityGHSA-72w5-pf8h-xfp4 · 2026-05-14DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
• VulnerabilityGHSA-88gh-2526-gfrr · 2026-05-14DeepSeek TUI has SSRF‌ IPV6 bypass
• VulnerabilityGHSA-wx44-2q6h-j6p8 · 2026-05-14DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
• VulnerabilityGHSA-96ff-gc8g-wpvg · 2026-05-14DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Check your version

Run cargo tree -i deepseek-tui to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.