| Title | deepseek-ai DeepSeek Harness ≤ `0.1.0-rc.5` Improper Resolution of Path Equivalence |
|---|
| Description | When dsh loads the bundle layer of a profile (`loadProfile` in `packages/boot/app-boot/src/profile.ts`), it reads each bundle's `package.json` and takes the declared `dsh.bundle.patch` field value (referred to as `declared`). It only checks whether this value is `undefined`, then directly uses `path.join(packageDir, declared)` to construct the absolute path of the patch file and reads it.
Because `declared` is entirely controlled by the bundle package's `package.json` (i.e., controllable by an attacker through a malicious package installed via `dsh plugin add`), and there is no path containment/traversal validation before concatenation, an attacker can include `../` segments or an absolute path in `declared`, causing `path.join` to escape the bundle package directory and point to arbitrary files outside the package directory. `loadProfile` then uses `loadOverlayPatches` to read that out-of-bounds path and parse it as a dsh patch list.
Combined with the diagnostic commands `dsh --profile <name> --dump-config` / `--dump-default-config` (which only parse, do not boot, and do not evaluate `!!js`), the parsed content of the traversed file is output to stdout, thereby disclosing arbitrary YAML/JSON file contents outside the package directory (such as configuration files containing credentials). This information disclosure impact is independent of the already reported `!!js` arbitrary code execution (eval sink): on the normal startup (boot) path, if the traversed file contains `!!js` expressions, they will also be evaluated (flowing into the same reported eval sink); whereas the `--dump-config` path discloses file contents without executing any code. |
|---|
| Source | ⚠️ https://github.com/deepseek-ai/deepseek-harness/discussions/3354 |
|---|
| User | rockmelodeis (UID 100628) |
|---|
| Submission | 08/19/2026 11:17 (1 month ago) |
|---|
| Moderation | 09/28/2026 09:14 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410989 [DeepSeek deepseek-harness up to 0.1.7-rc.2 Bundle Patch profile.ts loadProfile dsh.bundle.patch path traversal] |
|---|
| Points | 20 |
|---|