DeepSeek Harness CVE-2026-101132

Exploitation requires the attacker to supply a crafted dsh.bundle.patch argument that is processed by the loadProfile function of the Bundle Patch Handler (packages/boot/app-boot/src/profile.ts). Per the CVSS 4.0 vector, no privileges are required (PR:N) but passive user interaction is required (UI:P) - a user must load or apply the malicious bundle patch - and the attack has high complexity (AC:H), with VulDB explicitly describing exploitability as 'difficult.' Impact is limited to low confidentiality (VC:L: reading files outside the intended bundle path); there is no integrity or availability impact. Limiting factors: the product is a niche release-candidate AI harness with minimal deployment, the high-complexity barrier, and the requirement that a victim load attacker-controlled patch input.

This is a low-real-risk issue despite public exploit availability. The vendor CVSS 4.0 base score is 2.3 (Low), and the vector (AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable but high attack complexity ('the exploitability is described as difficult'), requiring passive user interaction, and yielding only low confidentiality impact (out-of-bundle file read) with no integrity or availability impact. VulDB is the sole source; there is no EPSS score and no CISA KEV listing, so there is no evidence of automated or widespread exploitation. A public exploit exists (VulDB-referenced GitHub discussion #3354), but POC availability is a distinct signal from active exploitation and does not by itself elevate priority given the AC:H barrier and minimal impact. The affected product - DeepSeek deepseek-harness, an early-stage (up to 0.1.7-rc.2 release-candidate) TS/Node AI agent harness - has a tiny deployment footprint, further limiting real-world exposure. Net: verifiable but low priority; not a candidate for emergency patching.

A remote attacker crafts a malicious dsh.bundle.patch value containing directory-traversal sequences and induces a user of the deepseek-harness to load it, causing loadProfile in profile.ts to resolve a path outside the intended bundle directory and disclose file contents. A public proof-of-concept exists (VulDB-referenced GitHub discussion #3354). Exploitation is rated difficult (high attack complexity) and depends on user interaction, so opportunistic mass exploitation is unlikely.