hkuds/deepcode vulnerabilities

Latest hkuds/deepcode CVEs

Newest publication first

1. CVE-2026-32847 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py

   Published 2026-05-28

   High·CVSS 8.7

   DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.