| タイトル | deepseek-ai deepseek-harness dsh-v0.1.0-rc.7 DeepSeek Harness `run_code` (Code Mode) executes model-written T |
|---|
| 説明 | DeepSeek Harness confines the agent's file effects through a kernel-grade sandbox seam (`ctx.sandbox`, implemented by `@deepseek-ai/dsh-sandbox-local` over bubblewrap / Landlock / Seatbelt on Linux/macOS). The two ordinary agent code paths both honor it: the bash tool runs through `@deepseek-ai/dsh-bash-sandbox`, which wraps every `bash -c` in `ctx.sandbox.confine(...)`, and the filesystem tools run through `@deepseek-ai/dsh-fs-sandbox`, which re-canonicalizes the target and requires containment under the workspace root before any mutation.
Code Mode adds a third execution path — the `run_code` tool — that is **not** run through the sandbox at all. `run_code` hands the model's TypeScript body to `@deepseek-ai/dsh-code-runtime-worker-thread`, which spawns a Node worker thread and executes the program with `new AsyncFunction(...)` under an empty environment and a heap/time budget, but with **no file-effect confinement**: no `--experimental-permission`, no `ctx.sandbox.confine()`, no Landlock/Seatbelt profile. Because the worker thread shares the host process's UID and the OS kernel with no file-effect policy applied, the model program can `await import('node:fs')` to read/write any file and `await import('node:child_process')` to spawn arbitrary unsandboxed processes.
The consequence: in a deployment that runs Code Mode (`DSH_TOOLS_MODE=code` or `both`) alongside the **default** sandbox policy (`read-only`, or the permission default `workspace-write`), `run_code` is a complete escape from the file-effect sandbox — reading secrets outside the workspace, writing persistence files (`~/.bashrc`, `~/.ssh/authorized_keys`, cron), and running unconfined commands, all capabilities the sandbox is specifically built to deny. |
|---|
| ソース | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| ユーザー | rockmelodeis (UID 100628) |
|---|
| 送信 | 2026年08月18日 17:29 (1 月 ago) |
|---|
| モデレーション | 2026年09月28日 04:59 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410977 [deepseek-ai deepseek-harness 迄 0.1.0-rc.7 Code Mode Sandbox run_code 特権昇格] |
|---|
| ポイント | 20 |
|---|