Deepseek Harness
Monthly
DeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within the dsh-workflow-worker-thread component's agent function (CWE-841), allowing an authenticated remote attacker who can also induce passive user interaction to partially bypass intended workflow sequencing, with limited confidentiality, integrity, and availability impact confined to the harness itself. Publicly available exploit code exists, but the requirement for low-privileged authentication (CVSS 4.0 PR:L) and user interaction (UI:P) keeps the issue medium severity (CVSS 4.0 base 5.1), and there is no confirmed CISA KEV listing for this CVE.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has code execution inside the Landlock-backed local sandbox break the intended isolation boundary through crafted mount profiles in packages/sandbox/sandbox-local/src/profiles.ts (CWE-653). The impact is limited to confidentiality, integrity, and availability (all Low), scored 4.8 under CVSS 4.0, and it is only relevant where the harness local sandbox is actually used as a trust boundary for untrusted agent or tool code; it is not remotely reachable and requires no user interaction but does require local, low-privileged access (AV:L/PR:L/UI:N). Publicly available exploit code exists (a GitHub write-up demonstrates the mount-escape technique), the vendor was contacted early but did not respond, and no vendor-released patch has been identified, making this a genuine but low-to-moderate priority local sandbox-escape issue rather than a remote critical.
DeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within the dsh-workflow-worker-thread component's agent function (CWE-841), allowing an authenticated remote attacker who can also induce passive user interaction to partially bypass intended workflow sequencing, with limited confidentiality, integrity, and availability impact confined to the harness itself. Publicly available exploit code exists, but the requirement for low-privileged authentication (CVSS 4.0 PR:L) and user interaction (UI:P) keeps the issue medium severity (CVSS 4.0 base 5.1), and there is no confirmed CISA KEV listing for this CVE.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has code execution inside the Landlock-backed local sandbox break the intended isolation boundary through crafted mount profiles in packages/sandbox/sandbox-local/src/profiles.ts (CWE-653). The impact is limited to confidentiality, integrity, and availability (all Low), scored 4.8 under CVSS 4.0, and it is only relevant where the harness local sandbox is actually used as a trust boundary for untrusted agent or tool code; it is not remotely reachable and requires no user interaction but does require local, low-privileged access (AV:L/PR:L/UI:N). Publicly available exploit code exists (a GitHub write-up demonstrates the mount-escape technique), the vendor was contacted early but did not respond, and no vendor-released patch has been identified, making this a genuine but low-to-moderate priority local sandbox-escape issue rather than a remote critical.