DeepSeek Harness (dsh): Untrusted search path allows arbitrary code execution
Summary
DeepSeek Harness (dsh) in commit c291e796 starts configured MCP servers by unqualified command name and resolves them through the PATH. A forged executable placed earlier in the search path, for example in a project's node_modules/.bin directory, can therefore be run with the privileges of the dsh process. NVD rates this CVSS 10.0 (critical), but the vector (no user interaction) conflicts with the description (a victim must open a crafted file), so the practical risk is likely local. No fixed version has been published.
Affected
- DeepSeek Harness (dsh), commit c291e796 (2026-09), according to the CVE record
- Unknown: other commits and released versions
Fixed in
Unknown. No vendor advisory or fixed release found.
Workaround
- Run dsh only from trusted directories and keep untrusted files out of the working directory.
- Use absolute paths for tools and MCP server commands where possible.
- Do not run dsh with elevated privileges.
- Test dsh in a virtual machine or container.
- Note: these measures are general recommendations, not vendor-confirmed mitigations.
Exploitation
- A public proof-of-concept is referenced in the CVE record.
- CISA SSVC data: exploitation poc, automatable yes, technical impact total.
- Not listed in the CISA KEV catalogue. No confirmed exploitation in the wild found.
Our recommendation
- Inventory dsh installations on developer workstations and shared hosts, including git checkouts.
- Restrict dsh to trusted projects and run it in a VM or container.
- Monitor for unexpected executables in node_modules/.bin and other PATH directories.
- Check the DeepSeek repository for a fix and update as soon as one is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record via OpenCVE app.opencve.io
- Vulners (Mend) entry vulners.com
- VulDB entry vuldb.com
- Strix CVE entry www.strix.ai
- DeepSeek Harness repository github.com
- DeepSeek vendor website deepseek.com
- Hugging Face mirror of DeepSeek Harness huggingface.co
- The Hacker News: related DSH flaw thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:13.
Original description (NVD)
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.