EUVD-2026-102903
GHSA-g5wx-c65h-w9px
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlace crafted executable in dsh search path
-
DeliveryImpersonate legitimate content file
-
ExploitVictim opens/runs via dsh
-
ExecutionUntrusted binary loaded from search path
-
ImpactArbitrary code execution as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | Exploitation requires the attacker to write a crafted executable into a directory that dsh (DeepSeek Harness, commit c291e796) consults as a search path, disguised in place of legitimate content, and then requires that executable to be opened/run via dsh. Limiting factors: this presumes local write access to a searched directory (or control of a shared/current working directory) and, per the description's 'opening crafted executable files,' a victim action to invoke the content - contradicting the input vector's AV:N/UI:N. The planted code executes with the invoking user's privileges. No specific version gate can be stated because affected versions are 'n/a' and only a commit hash is given. |
| Impact | Signals conflict sharply. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C, 10.0 Critical) describes a remote, unauthenticated, no-interaction compromise with scope change - the maximum possible score. However, the CWE-426 (Untrusted Search Path) classification and the description ('supplying and opening crafted executable files in place of legitimate content') both strongly imply LOCAL file placement plus a victim action to open/run the planted executable - i.e., AV:L and UI:R, not AV:N/UI:N. This is a material contradiction: the vector likely overstates real-world reachability. SSVC adds Exploitation:poc, Automatable:yes, Technical Impact:total, and public POC code exists (gist + GitHub repo), so working exploit tooling is available. There is NO CISA KEV listing and no EPSS score is provided, so there is no evidence of widespread active exploitation. Net: treat as a genuine code-execution flaw with public POC, but the headline 10.0 is probably inflated by an over-broad attack-vector assignment; the practical risk is gated by local access and/or user interaction. Verify the true vector with the POC and vendor before prioritizing as a network-wide critical. |
| Exploit ScenarioDerived | An attacker plants a crafted malicious executable in a directory that DeepSeek Harness (dsh) searches when loading or opening content, named to impersonate legitimate content. When a user runs dsh in or against that location, the untrusted executable is loaded and runs with the user's privileges, yielding arbitrary code execution. Public POC code exists (GitHub lkloliver/poc and a gist), lowering the skill barrier, though the description implies the victim must open/run the planted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Arbitrary code execution in DeepSeek Harness (dsh) at commit c291e796 stems from an untrusted search path weakness, letting an attacker plant a crafted executable in a location dsh consults when resolving content, so that the malicious file is run in place of the legitimate one. Exploitation is not automatic: per our independent assessment the attacker first needs write access to a searched directory (or control of a shared/current working directory) and then must induce a victim to open or run the substituted content, so the realistic vector is local with user interaction (AV:L/UI:R), not the network-facing, no-interaction 10.0 score supplied in the source feed. Publicly available exploit code exists (SSVC exploitation status 'poc', with a PoC repository referenced), the issue is rated fully automatable with total technical impact, and no CISA KEV listing was provided - so this is a proof-of-concept-stage risk rather than confirmed active exploitation.
RemediationAI
No vendor-released patch or fixed version was identified at the time of analysis, and the only version marker available is commit c291e796, so remediation must currently rely on hardening the search path rather than upgrading to a stated release. Practical compensating controls, in priority order: (1) prevent dsh from ever being launched from, or pointed at, attacker-writable locations - enforce strict filesystem permissions (remove world/group write on every directory dsh searches, including the current working directory and any plugin or script folders) and, on Windows, strip writable directories such as the working directory from loader resolution and enforce SafeDllSearchMode and KnownDLLs; trade-off is that permissive shared staging or CI working directories will need re-architecture, which can break existing workflows. (2) Never open, import, or execute content files obtained from untrusted or shared sources through dsh, and apply application allowlisting (e.g., AppLocker/WDAC or SELinux/AppArmor exec policies) so only signed, trusted binaries in trusted directories may run; trade-off is false-positive blocking of legitimate third-party tooling. (3) Run dsh under a dedicated low-privilege service account with no write access to its own installation or search directories, containing the blast radius of any substituted executable - trade-off is that features requiring elevated or broader filesystem access will need explicit, narrow delegation. (4) Monitor and audit file creation in dsh-consulted directories and alert on newly written executables, which is detection rather than prevention. Because publicly available exploit code exists for this CVE, prioritize the directory-permission hardening and allowlisting controls even in the absence of a patch; re-check the vendor site (http://deepseek.com) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-95182) for a patched release, and validate the assessed local/UI:R vector (rather than the 10.0 network score) when prioritizing, as exploitation presupposes local write access plus a victim opening the crafted content.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-426, Untrusted Search Path: the application resolves an executable or runnable artifact by searching a path that an attacker can influence, rather than by using an absolute, trusted location. Classic manifestations include Windows DLL/EXE hijacking, Unix PATH or current-working-directory resolution, and plugin/loader directories that are writable by non-privileged users. Here the affected component is DeepSeek Harness (dsh) at commit c291e796, and the supplied CPE 'cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*' plus EUVD affected-version list of 'n/a n/a' mean no version boundary can be derived - the commit hash is the only reliable identifier. Note the sharp conflict between the feed's CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C vector (score 10.0, suggesting an unauthenticated remote compromise) and our assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: the description's requirement to supply and then open crafted files implies local path access and a victim action, so scope is unchanged (S:U) and the attacker executes with the invoking user's privileges rather than gaining a scope escape. Cross-references include EUVD-2026-102903, a GitHub PoC tree at lkloliver/poc for CVE-2026-95182, and a gist by the same researcher.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Untrusted search path (CWE-426) with 'opening crafted executable files' implies local file placement and victim action, so AV:L and UI:R; total impact gives C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
Executive ViewAI
DeepSeek Harness (dsh) at commit c291e796 is affected by CVE-2026-95182, a critical arbitrary code execution flaw that can lead to full compromise of the user session running dsh. Publicly available exploit code exists, but no CISA KEV listing was provided and no vendor-released patch identified at time of analysis, so this is a proof-of-concept-stage risk that requires local write access and user interaction rather than active exploitation. Leadership should prioritize containment for teams using dsh in shared or developer-managed environments because successful exploitation could enable credential theft, unauthorized data access, or lateral movement.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict write access to dsh search paths and shared/current working directories; run dsh only from trusted directories and with least privilege; enforce application allowlisting and EDR alerts for unexpected executables; monitor for CVE-2026-95182 PoC indicators; and apply the vendor patch immediately once released.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB