AsyncFuncAI vulnerabilities
We track 4 vulnerabilities in AsyncFuncAI products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest AsyncFuncAI vulnerabilities
- 7.5 High severity
deepwiki-open: External Control of File Name or Path
DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file a
- 7.5 High severity
deepwiki-open: External Control of File Name or Path
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all fil
- 7.5 High severity
deepwiki-open: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute
- 9.8 Critical severity
deepwiki-open: Improper Limitation of a Pathname to a Restricted Directory
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user