| Title | DeepSeek DeepSeek Harness 0.1.0-rc.5 设计错误 / Design Error |
|---|
| Description | ## Description
The product `dsh` enforces a second gate on environment variables: a frozen
launch-environment snapshot (`DSH_LAUNCH_ENVIRONMENT_KEY`) that plugins are
expected to resolve through `launchEnvironmentOf(ctx)`. The DeepSeek LLM plugin
follows this discipline (`launchEnvironmentOf(ctx).get("DEEPSEEK_API_KEY")`),
but `@deepseek-ai/dsh-e2b` bypasses it:
```js
const apiKey = config.apiKey ?? process.env.E2B_API_KEY // packages/e2b/e2b/src/index.ts:94
```
Because `E2B_API_KEY` is not in the bootstrap allow-list (`isBootstrapOnly`),
a value injected via the project `.env` file is materialized into
`process.env` by `loadLayeredEnv`. When the e2b composition is declared without
an inline `apiKey`, this fallback is triggered: an attacker who can write the
project `.env` file can cause the operator's E2B sandbox (`fs-e2b` /
`subprocess-e2b`) to be created under the attacker's own E2B account,
exfiltrating the operator's file contents and command I/O to an
attacker-controlled remote sandbox.
Root-cause locations:
- `packages/e2b/e2b/src/index.ts:94` — direct `process.env.E2B_API_KEY` read
- `packages/e2b/e2b/src/index.ts:151` — `Sandbox.create({ apiKey })` binding point
- `packages/boot/app-boot/src/index.ts:93` — bootstrap allow-list omits `E2B_API_KEY`
- `packages/boot/app-boot/src/index.ts:187` — `.env` value materialized into `process.env`
Contrast (correct pattern):
- `packages/llm/llm-deepseek/src/index.ts:225` — resolves credentials via
`launchEnvironmentOf(ctx).get(ref)`, tracking the source layer.
## Impact
Operator's E2B sandbox bound to an attacker-controlled E2B account; file
contents and command I/O exfiltrated to the attacker's remote sandbox.
## Proof of concept
Attacker writes project `.env`:
```
E2B_API_KEY=e2b_attacker_controlled_key_1234567890
```
e2b composition row (no inline `apiKey`, triggering the environment fallback):
```yaml
- id: e2b
name: '@deepseek-ai/dsh-e2b'
config:
cwd: !!js process.cwd()
timeoutMs: 300000
```
Verified locally (no network): `isBootstrapOnly("E2B_API_KEY")` returns
`false` (passes the gate), the `.env` value is materialized into
`process.env`, and `config.apiKey ?? process.env.E2B_API_KEY` resolves to the
attacker-controlled key. |
|---|
| Source | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| User | Piggy Sprint (UID 100649) |
|---|
| Submission | 08/19/2026 10:36 (2 months ago) |
|---|
| Moderation | 09/28/2026 09:14 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410988 [deepseek-ai deepseek-harness up to 0.1.5-rc.3 dsh index.ts E2B_API_KEY reliance on untrusted inputs in a security decision] |
|---|
| Points | 20 |
|---|