| Titolo | DeepSeek DeepSeek Harness Path Traversal CWE-22 |
|---|
| Descrizione | A vulnerability was found in DeepSeek Harness (@deepseek-ai/dsh) up to 0.1.0-rc.7. It has been classified as a path traversal (medium severity). This affects the loadProfile function in packages/boot/app-boot/src/profile.ts. The manipulation of the dsh.bundle.patch manifest field, which is fully controlled by an installed bundle's package.json, leads to reading an arbitrary file outside the bundle directory. Exploitation requires an operator to install a malicious bundle and then run "dsh --profile <name> --dump-config", which prints the traversed file's parsed contents. |
|---|
| Fonte | ⚠️ https://gist.github.com/jsxzxyr/bd84ad560e57508140c06f85cae07fce |
|---|
| Utente | Rain_219 (UID 100764) |
|---|
| Sottomissione | 24/08/2026 04:20 (2 mesi fa) |
|---|
| Moderazione | 10/10/2026 15:20 (2 months later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 410989 [DeepSeek deepseek-harness fino a 0.1.7-rc.2 Bundle Patch profile.ts loadProfile dsh.bundle.patch directory traversal] |
|---|
| Punti | 0 |
|---|