GitLab discloses DeepSeek-Reasonix flaw triggered by viewing diffs

GitLab disclosed a command-execution vulnerability in DeepSeek-Reasonix Studio that can run attacker code when a developer views a file's diff. Its researchers recommend updating to Studio 2.21.0 or DeepSeek Reasonix npm 1.39.3. The flaw uses repository configuration to select a command that Git runs while preparing file content for comparison. Existing protections against external diff commands do not block this filter. Delivery requires a repository's local configuration through an archive, synced folder, CI cache or devcontainer build; ordinary HTTPS or SSH clones do not transfer it. A compromised coding agent with local filesystem access can also write the malicious configuration directly.