| शीर्षक | DeepSeek DeepSeek Harness 0.1.0-rc.5 设计错误 / Design Error |
|---|
| विवरण | ## Description
The product `dsh` enforces a second gate on environment variables: a frozen
launch-environment snapshot (`DSH_LAUNCH_ENVIRONMENT_KEY`) that plugins are
expected to resolve through `launchEnvironmentOf(ctx)`. The DeepSeek LLM plugin
follows this discipline (`launchEnvironmentOf(ctx).get("DEEPSEEK_API_KEY")`),
but `@deepseek-ai/dsh-e2b` bypasses it:
```js
const apiKey = config.apiKey ?? process.env.E2B_API_KEY // packages/e2b/e2b/src/index.ts:94
```
Because `E2B_API_KEY` is not in the bootstrap allow-list (`isBootstrapOnly`),
a value injected via the project `.env` file is materialized into
`process.env` by `loadLayeredEnv`. When the e2b composition is declared without
an inline `apiKey`, this fallback is triggered: an attacker who can write the
project `.env` file can cause the operator's E2B sandbox (`fs-e2b` /
`subprocess-e2b`) to be created under the attacker's own E2B account,
exfiltrating the operator's file contents and command I/O to an
attacker-controlled remote sandbox.
Root-cause locations:
- `packages/e2b/e2b/src/index.ts:94` — direct `process.env.E2B_API_KEY` read
- `packages/e2b/e2b/src/index.ts:151` — `Sandbox.create({ apiKey })` binding point
- `packages/boot/app-boot/src/index.ts:93` — bootstrap allow-list omits `E2B_API_KEY`
- `packages/boot/app-boot/src/index.ts:187` — `.env` value materialized into `process.env`
Contrast (correct pattern):
- `packages/llm/llm-deepseek/src/index.ts:225` — resolves credentials via
`launchEnvironmentOf(ctx).get(ref)`, tracking the source layer.
## Impact
Operator's E2B sandbox bound to an attacker-controlled E2B account; file
contents and command I/O exfiltrated to the attacker's remote sandbox.
## Proof of concept
Attacker writes project `.env`:
```
E2B_API_KEY=e2b_attacker_controlled_key_1234567890
```
e2b composition row (no inline `apiKey`, triggering the environment fallback):
```yaml
- id: e2b
name: '@deepseek-ai/dsh-e2b'
config:
cwd: !!js process.cwd()
timeoutMs: 300000
```
Verified locally (no network): `isBootstrapOnly("E2B_API_KEY")` returns
`false` (passes the gate), the `.env` value is materialized into
`process.env`, and `config.apiKey ?? process.env.E2B_API_KEY` resolves to the
attacker-controlled key. |
|---|
| स्रोत | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| उपयोगकर्ता | Piggy Sprint (UID 100649) |
|---|
| सबमिशन | 19/08/2026 10:36 AM (2 महीनों पहले) |
|---|
| संयम | 28/09/2026 09:14 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 410988 [deepseek-ai deepseek-harness तक 0.1.5-rc.3 dsh index.ts E2B_API_KEY सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|