| 标题 | deepseek-ai deepseek-harness dsh-v0.1.0-rc.7 DeepSeek Harness `run_code` (Code Mode) executes model-written T |
|---|
| 描述 | DeepSeek Harness confines the agent's file effects through a kernel-grade sandbox seam (`ctx.sandbox`, implemented by `@deepseek-ai/dsh-sandbox-local` over bubblewrap / Landlock / Seatbelt on Linux/macOS). The two ordinary agent code paths both honor it: the bash tool runs through `@deepseek-ai/dsh-bash-sandbox`, which wraps every `bash -c` in `ctx.sandbox.confine(...)`, and the filesystem tools run through `@deepseek-ai/dsh-fs-sandbox`, which re-canonicalizes the target and requires containment under the workspace root before any mutation.
Code Mode adds a third execution path — the `run_code` tool — that is **not** run through the sandbox at all. `run_code` hands the model's TypeScript body to `@deepseek-ai/dsh-code-runtime-worker-thread`, which spawns a Node worker thread and executes the program with `new AsyncFunction(...)` under an empty environment and a heap/time budget, but with **no file-effect confinement**: no `--experimental-permission`, no `ctx.sandbox.confine()`, no Landlock/Seatbelt profile. Because the worker thread shares the host process's UID and the OS kernel with no file-effect policy applied, the model program can `await import('node:fs')` to read/write any file and `await import('node:child_process')` to spawn arbitrary unsandboxed processes.
The consequence: in a deployment that runs Code Mode (`DSH_TOOLS_MODE=code` or `both`) alongside the **default** sandbox policy (`read-only`, or the permission default `workspace-write`), `run_code` is a complete escape from the file-effect sandbox — reading secrets outside the workspace, writing persistence files (`~/.bashrc`, `~/.ssh/authorized_keys`, cron), and running unconfined commands, all capabilities the sandbox is specifically built to deny. |
|---|
| 来源 | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| 用户 | rockmelodeis (UID 100628) |
|---|
| 提交 | 2026-08-18 17時29分 (1 月前) |
|---|
| 管理 | 2026-09-28 04時59分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410977 [deepseek-ai deepseek-harness 直到 0.1.0-rc.7 Code Mode Sandbox run_code 权限提升] |
|---|
| 积分 | 20 |
|---|