CVE-2026-101131
LowCVSS 3.3Summary
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3 in an unknown function of the file packages/e2b/e2b/src/index.ts in the dsh component. Manipulating the E2B_API_KEY argument leads to reliance on untrusted inputs in a security decision, and local access is required. The exploit is publicly available and might be used; the vendor did not respond.
Risk Assessment
An attacker with local access can exploit untrusted input to make an incorrect security decision, potentially leading to unauthorized access. The public exploit increases the risk of exploitation.
Recommendation
Contact the vendor for a fix and consider restricting local access to the application. Until a patch is released, verify and validate inputs used in security decisions.
Other vulnerabilities in deepseek-harness
See all- CVE-2026-101132Low
A security flaw was discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2 in the loadProfile function of the file packages/boot/app-boot/src/profile.ts in the Bundle Patch Handler component. Manipulating the dsh.bundle.patch argument results in path traversal, and the attack may be performed remotely, though it requires high complexity. The exploit has been released publicly and may be used; the vendor did not respond.
- CVE-2026-101102Medium
A vulnerability found in deepseek-ai deepseek-harness up to 0.1.0-rc.7 affects the run_code function of the Code Mode Sandbox component. Manipulation leads to a sandbox issue, and the attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes explicitly state the worker is "containment, not a security boundary".
- CVE-2026-101078Medium
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. An unknown function in packages/sandbox/sandbox-local/src/profiles.ts of the Landlock Backend component leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public. The vendor did not respond.
- CVE-2026-82533Critical
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.
Original NVD description (English source)
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2B_API_KEY leads to reliance on untrusted inputs in a security decision. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS