Overview
DeepSeek Harness — distributed as the dsh CLI and marketed by DeepSeek-AI as an open-source, plugin-based agent framework for autonomous coding tasks — contains a critical untrusted search path vulnerability tracked as CVE-2026-95182. It carries a maximum CVSS v3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a network-reachable, zero-interaction attack path with a changed scope of impact.
The flaw, indexed under CWE-426 (Untrusted Search Path), means the harness can be induced to resolve and execute an attacker-supplied executable file in place of the legitimate tool or binary it intended to run.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-95182 |
| Severity | Critical (CVSS 3.1: 10.0) |
| CWE | CWE-426 — Untrusted Search Path |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |
| Affected Component | DeepSeek Harness (dsh), commit c291e796 |
| Fixed Version | Not publicly confirmed at time of writing |
| Reserved | 2026-09-22 |
| Published | 2026-10-16 |
How It Works
Per the public advisory description, the vulnerability "allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content." In practice, this is the classic binary-planting / search-path hijack pattern: when the harness resolves a path to a helper tool or executable, it does so in a way that can be satisfied by an attacker-controlled file — for example, one dropped into a working directory, a cloned repository, or another location the harness scans — rather than the vendor-intended binary. Because AI coding agents like dsh are specifically designed to operate on untrusted or semi-trusted repository content (cloning, building, and running code the agent itself has not vetted), this class of flaw is especially dangerous: the attacker-controlled input the agent processes is exactly the kind of content most likely to carry a malicious planted executable.
Context: An Experimental Tool by Design
DeepSeek Harness's own SAFETY.md documentation describes the project as experimental developer-preview software that has not undergone a formal security audit and explicitly states it must not be treated as secure or production-ready. The project's sandboxing, approval prompts, and permission controls are described as risk-reducing, not isolation-guaranteeing — and the documentation notes that even correctly enforced restrictions cannot protect resources the harness is already permitted to access. CVE-2026-95182 is the latest in a short but growing list of disclosed dsh flaws, following CVE-2026-82533 (an authentication bypass in its local HTTP control-plane API via Host-header spoofing) and a related context-compaction prompt-injection issue (CVE-2026-95183) disclosed in the same window.
Impact Assessment
Who Is At Risk
- Developers and organizations running
dshto autonomously clone, build, test, or review code from repositories they do not fully control or trust - CI/CD pipelines or automation that invoke DeepSeek Harness against externally-sourced or user-submitted code
- Any environment where the harness's working directory or tool-resolution path can be influenced by content the agent itself fetched or generated
Potential Attack Chains
- Content Delivery — Attacker plants a maliciously named executable inside a repository, package, or directory the harness will process (e.g., via a pull request, a dependency, or a crafted project it's asked to analyze)
- Path Resolution — The harness searches for a legitimate tool using a resolution order that can be satisfied by the planted file before — or instead of — the real one
- Execution —
dshlaunches the attacker's executable with the harness's own privileges - Compromise — The attacker gains code execution in the context running the agent, potentially extending to credentials, API keys, or source code the harness has access to
Given that AI coding agents frequently run with access to developer credentials, cloud tokens, or CI secrets, a successful exploit here can escalate quickly beyond the immediate host.
Mitigation
Immediate Actions
- Do not point DeepSeek Harness at untrusted repositories or content until an official, vendor-confirmed fix is available — no patched version has been publicly documented for CVE-2026-95182 at time of writing
- Run
dshinside a disposable, isolated sandbox or container with no access to credentials, secrets, or networks beyond what a given task strictly requires - Pin and audit the exact commit/version of
dshin use, and monitor the upstreamdeepseek-ai/deepseek-harnessrepository for a security advisory and patched release - Where
dshis wired into CI/CD, restrict it to pipelines operating on fully trusted, internally-authored code only
Detection Opportunities
- Monitor for unexpected child-process execution originating from
dsh's working directories, particularly binaries not shipped with the harness itself - Audit CI logs for tool invocations resolving to unexpected paths (e.g., a repository-local file shadowing a system binary)
- Treat any anomalous outbound network activity or credential access from agent-execution hosts as a priority investigation lead
Defence-in-Depth
- Apply the same "assume breach" posture to AI coding agents that you would to any tool executing untrusted, attacker-reachable input — least privilege, network egress controls, and ephemeral execution environments
- Avoid storing long-lived credentials or cloud tokens in environments where autonomous agent harnesses operate
- Track the project's own
SAFETY.mdguidance; DeepSeek-AI has been explicit that the harness is not hardened for production use
Discovery & Disclosure
CVE-2026-95182 was reserved on 2026-09-22 and published on 2026-10-16 against DeepSeek Harness commit c291e796. As of publication, it carries no confirmed patched version in public advisory data, is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept has been confirmed — but the maximum CVSS score and the nature of AI coding agents processing attacker-reachable content mean this should be treated as an active risk for any dsh deployment handling untrusted code.