Live › vulnerability › CVE-2026-95182
Go to dashboardDeepSeek Harness (dsh, developer preview) starts MCP servers by bare command name, such as npx, and the child process inherits the host PATH. In pnpm source checkouts node_modules/.bin comes first on PATH, and the model can write there under the default workspace-write sandbox. An agent steered by injected content (web page, email, ticket, cloned repo) can plant a fake npx there. Every later start or reconnect of that MCP server then runs the attacker's file as a long-lived process with the server's tools and secrets, and the sandbox does not restrict network egress. The researcher says @deepseek-ai/dsh-sandbox-local has the same bare-name spawn. The researcher's PoC is public. Verified through master commit c291e796 on Linux and macOS. No fixed commit or version has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| deepseek-harness | vendor | master commit c291e796 (2026-09) and possibly later; developer preview | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
This page as .md · .json · in your agent: get_signal("CVE-2026-95182")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.