DeepSeek Harness EUVD-2026-97158

Exploitation targets the agent function within the dsh-workflow-worker-thread component of deepseek-harness (versions up to and including 0.1.1-rc.2). The CVSS 4.0 vector requires PR:L, so the attacker must hold at least low-level authenticated access to the harness/workflow interface - not anonymous access. UI:P additionally requires passive user interaction, meaning a legitimate user must trigger or traverse the affected workflow path for the attack to land; this user-interaction dependency and the authentication requirement are the primary factors limiting real-world exploitation. Impact is confined to the vulnerable system (no scope change) with only partial C/I/A effects.

This is a medium-severity issue (CVSS 4.0 base 5.1) that does not rise to a top priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates a network-reachable flaw with low attack complexity but requiring at least low-level privileges (PR:L, i.e. an authenticated actor) and passive user interaction (UI:P), which materially constrains mass exploitation. Technical impact is limited: VC:L/VI:L/VA:L means only partial confidentiality, integrity, and availability effects on the vulnerable system, with no scope change (SC:N/SI:N/SA:N). The input embeds E:P (Proof-of-Concept) and a public exploit reference, so publicly available exploit code exists - but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation; POC availability and active exploitation are distinct signals. Note a tension between the data and the product: the 'Information Disclosure' tag and the C-impact conflict somewhat with CWE-841 (Improper Enforcement of Behavioral Workflow), which is about bypassing an intended sequence of operations rather than classic data leakage - treat the 'Information Disclosure' characterization as low-confidence. The sole intelligence source is VulDB; the vendor (DeepSeek) was contacted and did not respond, so affected-version and fix data are unconfirmed. Net: a real but bounded issue, best triaged as medium pending vendor confirmation.

An authenticated user of a deepseek-harness deployment (≤ 0.1.1-rc.2) sends crafted input to the agent function in the dsh-workflow-worker-thread component to subvert the intended workflow sequence, causing the worker to skip or reorder enforced steps. A public proof-of-concept is referenced, and because UI:P applies, the attack also depends on another user passively triggering the affected workflow path. The resulting impact is partial compromise of the processed data and workflow integrity on the host system.