deepseek-harness Sandbox and Workflow Flaws

DeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within the dsh-workflow-worker-thread component's agent function (CWE-841), allowing an authenticated remote attacker who can also induce passive user interaction to partially bypass intended workflow sequencing, with limited confidentiality, integrity, and availability impact confined to the harness itself. Publicly available exploit code exists, but the requirement for low-privileged authentication (CVSS 4.0 PR:L) and user interaction (UI:P) keeps the issue medium severity (CVSS 4.0 base 5.1), and there is no confirmed CISA KEV listing for this CVE.

Local authenticated attackers with low privileges can bypass or break the Sandbox component in deepseek-harness up to 0.1.1-rc.2 by manipulating the 'Profile' argument to the spawn function, resulting in a sandbox issue that may lead to limited privilege escalation. Publicly available exploit code exists, but the impact is capped at Low for confidentiality, integrity, and availability with no scope change, making this a low-priority issue. The vendor did not respond to disclosure, and no patch has been identified.