| 제목 | deepseek-ai deepseek-harness dsh-v0.1.0-rc.7 DeepSeek Harness `run_code` (Code Mode) executes model-written T |
|---|
| 설명 | DeepSeek Harness confines the agent's file effects through a kernel-grade sandbox seam (`ctx.sandbox`, implemented by `@deepseek-ai/dsh-sandbox-local` over bubblewrap / Landlock / Seatbelt on Linux/macOS). The two ordinary agent code paths both honor it: the bash tool runs through `@deepseek-ai/dsh-bash-sandbox`, which wraps every `bash -c` in `ctx.sandbox.confine(...)`, and the filesystem tools run through `@deepseek-ai/dsh-fs-sandbox`, which re-canonicalizes the target and requires containment under the workspace root before any mutation.
Code Mode adds a third execution path — the `run_code` tool — that is **not** run through the sandbox at all. `run_code` hands the model's TypeScript body to `@deepseek-ai/dsh-code-runtime-worker-thread`, which spawns a Node worker thread and executes the program with `new AsyncFunction(...)` under an empty environment and a heap/time budget, but with **no file-effect confinement**: no `--experimental-permission`, no `ctx.sandbox.confine()`, no Landlock/Seatbelt profile. Because the worker thread shares the host process's UID and the OS kernel with no file-effect policy applied, the model program can `await import('node:fs')` to read/write any file and `await import('node:child_process')` to spawn arbitrary unsandboxed processes.
The consequence: in a deployment that runs Code Mode (`DSH_TOOLS_MODE=code` or `both`) alongside the **default** sandbox policy (`read-only`, or the permission default `workspace-write`), `run_code` is a complete escape from the file-effect sandbox — reading secrets outside the workspace, writing persistence files (`~/.bashrc`, `~/.ssh/authorized_keys`, cron), and running unconfined commands, all capabilities the sandbox is specifically built to deny. |
|---|
| 원천 | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| 사용자 | rockmelodeis (UID 100628) |
|---|
| 제출 | 2026. 08. 18. PM 05:29 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 28. AM 04:59 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410977 [deepseek-ai deepseek-harness 까지 0.1.0-rc.7 Code Mode Sandbox run_code 권한 상승] |
|---|
| 포인트들 | 20 |
|---|