EUVD-2026-88404
GHSA-vcc3-4jvw-qx89
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSet/manipulate E2B_API_KEY input to dsh
-
ExecutionUntrusted value drives security decision in index.ts
-
ImpactLimited information disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Trusted input validation
|
| Exploitation Conditions | Requires local access to a host running deepseek-harness (<=0.1.5-rc.3) with existing low-level privileges (PR:L) sufficient to influence the E2B_API_KEY argument passed to the e2b/dsh component in packages/e2b/e2b/src/index.ts. No user interaction is needed (UI:N), but the local vector (AV:L) and pre-existing privilege requirement are the primary limiting factors; there is no remote/network exploitation path. Impact is confined to limited confidentiality (VC:L) with no integrity or availability effect, and no patched version exists since the vendor did not respond. |
| Impact | This is a low-severity, low-priority issue despite the presence of a public exploit. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) confirms local access and existing low privileges are required, with only limited confidentiality impact and no integrity or availability impact - consistent with the vendor's 4.8 (Medium) score. SSVC-style reading: exploitation is at 'proof-of-concept' (E:P in the vector; VulDB states the exploit is publicly available), it is NOT automatable (local, requires prior low-privilege access), and technical impact is partial/low. No EPSS score and no CISA KEV entry were provided, and there is no evidence of active exploitation. The signals are internally consistent - a genuinely local, authenticated, low-impact CWE-807 (reliance on untrusted input for a security decision) flaw. The public PoC raises awareness but the local + PR:L barrier and minimal impact keep real-world risk low. Note the 'Information Disclosure' tag is only partially justified: the vector carries VC:L (some confidentiality), but CWE-807 fundamentally describes a trust/security-decision integrity weakness, so the labeling is imprecise. |
| Exploit ScenarioDerived | A low-privileged local user or process on a host running deepseek-harness manipulates the E2B_API_KEY argument consumed by packages/e2b/e2b/src/index.ts (the 'dsh' component), which is trusted for a security decision without validation. By supplying an attacker-influenced value the actor skews that trust decision to disclose limited information. A public proof-of-concept exists, though exploitation still requires prior local access with existing privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor did not respond to early disclosure. Until a fix is available, restrict local access to hosts running DeepSeek Harness to trusted users and run the harness under a dedicated low-privilege account, understanding that this may reduce operational flexibility. Load E2B_API_KEY from a protected secret store or trusted configuration and prevent local users from overriding it via process arguments or environment files, which can complicate local development. If the E2B/dsh integration is not required, disable that component entirely to remove the vulnerable code path, accepting loss of sandbox functionality. Monitor https://vuldb.com/vuln/410988 and the related VulDB CTI page https://vuldb.com/vuln/410988/cti for updated guidance; because exploitation requires local access and low privileges, the primary practical control is limiting local shell and environment-variable access on affected systems.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-807 (Reliance on Untrusted Inputs in a Security Decision) is the root cause: the dsh component in packages/e2b/e2b/src/index.ts uses E2B_API_KEY as part of a security decision, and that value can be influenced by a local actor rather than being validated against a trusted source. The affected package is deepseek-ai deepseek-harness, with CPE cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:* covering versions up to 0.1.5-rc.3. The CVSS v4.0 vector indicates AV:L/AC:L/AT:N/PR:L/UI:N with VC:L and no VI/VA or subsequent system impact, matching the independent assessment of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation therefore requires local access and low privileges, with no remote or network path, and the result is limited confidentiality exposure.
Know when Deepseek Harness gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Local access with pre-existing low privileges to manipulate the E2B_API_KEY argument (AV:L/PR:L), no user interaction, and only limited confidentiality impact (C:L) with no integrity/availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2B_API_KEY leads to reliance on untrusted inputs in a security decision. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Deepseek Harness
View allDeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has cod
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the
Exploit-DB