| Title | DeepSeek DeepSeek Harness Path Traversal CWE-22 |
|---|
| Description | A vulnerability was found in DeepSeek Harness (@deepseek-ai/dsh) up to 0.1.0-rc.7. It has been classified as a path traversal (medium severity). This affects the loadProfile function in packages/boot/app-boot/src/profile.ts. The manipulation of the dsh.bundle.patch manifest field, which is fully controlled by an installed bundle's package.json, leads to reading an arbitrary file outside the bundle directory. Exploitation requires an operator to install a malicious bundle and then run "dsh --profile <name> --dump-config", which prints the traversed file's parsed contents. |
|---|
| Source | ⚠️ https://gist.github.com/jsxzxyr/bd84ad560e57508140c06f85cae07fce |
|---|
| User | Rain_219 (UID 100764) |
|---|
| Submission | 08/24/2026 04:20 (2 months ago) |
|---|
| Moderation | 10/10/2026 15:20 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 410989 [DeepSeek deepseek-harness up to 0.1.7-rc.2 Bundle Patch profile.ts loadProfile dsh.bundle.patch path traversal] |
|---|
| Points | 0 |
|---|