deepseek-harness vulnerabilities

A security flaw was discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2 in the loadProfile function of the file packages/boot/app-boot/src/profile.ts in the Bundle Patch Handler component. Manipulating the dsh.bundle.patch argument results in path traversal, and the attack may be performed remotely, though it requires high complexity. The exploit has been released publicly and may be used; the vendor did not respond.

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3 in an unknown function of the file packages/e2b/e2b/src/index.ts in the dsh component. Manipulating the E2B_API_KEY argument leads to reliance on untrusted inputs in a security decision, and local access is required. The exploit is publicly available and might be used; the vendor did not respond.

A vulnerability found in deepseek-ai deepseek-harness up to 0.1.0-rc.7 affects the run_code function of the Code Mode Sandbox component. Manipulation leads to a sandbox issue, and the attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes explicitly state the worker is "containment, not a security boundary".

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. An unknown function in packages/sandbox/sandbox-local/src/profiles.ts of the Landlock Backend component leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public. The vendor did not respond.

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.