{"id":"CVE-2026-95182","kind":"vulnerability","aliases":["CVE-2026-95182"],"related":[],"title":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via…","description":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","summary":"DeepSeek Harness (dsh, developer preview) starts MCP servers by bare command name, such as npx, and the child process inherits the host PATH. In pnpm source checkouts node_modules/.bin comes first on PATH, and the model can write there under the default workspace-write sandbox. An agent steered by injected content (web page, email, ticket, cloned repo) can plant a fake npx there. Every later start or reconnect of that MCP server then runs the attacker's file as a long-lived process with the server's tools and secrets, and the sandbox does not restrict network egress. The researcher says @deepseek-ai/dsh-sandbox-local has the same bare-name spawn. The researcher's PoC is public. Verified through master commit c291e796 on Linux and macOS. No fixed commit or version has been published.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"deepseek-harness","fixed":[],"affected":"master commit c291e796 (2026-09) and possibly later; developer preview","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","deepseek-harness","dsh","mcp","pnpm","prompt-injection","self-hosted"],"not_affected_if":["absolute-mcp-command-paths","no-workspace-write","not-source-checkout"],"how_to_check":"You are exposed if you run dsh from a source checkout at or after c291e796 with MCP servers configured by bare command (command: npx) and the agent can write to the workspace. Look in your dsh MCP config for non-absolute command values. Run ls -la node_modules/.bin and look for launchers you did not install or that changed recently. Check git log for the commit you run.","fix":"No fix published yet. Mitigate now: set MCP server commands to absolute paths. Keep node_modules/.bin out of the model's writable paths. Do not let dsh read untrusted content while it can write to the workspace. Restrict egress. Watch deepseek-ai/deepseek-harness for a fix.","status":"open","published_at":"2026-10-16T15:17:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T21:59:25+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T21:59:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","impact":"high","summary":"DeepSeek Harness (dsh) at commit c291e796 uses an untrusted search path, so it loads attacker-supplied executables in place of legitimate content. An attacker who gets a user to open a crafted executable can run arbitrary code on that user's machine.","category":"ai-tooling","who_cares":["deepseek-harness","dsh"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on victim machine via crafted executable files","analyst_note":"Check the NVD entry and the DeepSeek Harness repository for affected versions, the fixed commit, and which search path and file types are involved (https://nvd.nist.gov/vuln/detail/CVE-2026-95182).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000773,"input_tokens":2728,"output_tokens":1001,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the DeepSeek Harness repository for affected versions, the fixed commit, and which search path and file types are involved (https://nvd.nist.gov/vuln/detail/CVE-2026-95182).","search":"'-2026':19A,22A '-95182':20A,23A '/dsh-sandbox-local':148B 'agent':89B 'ai':28B,147B 'ai-tool':27B 'allow':11A,189C 'arbitrari':15A,193C 'attack':12A,118B,190C 'bare':51B,153B 'bare-nam':152B 'c291e796':10A,166B,188C 'checkout':68B 'child':59B 'clone':98B 'code':16A,194C 'come':71B 'command':52B 'commit':9A,165B,173B,187C 'content':93B,206C 'craft':199C 'cve':18A,21A 'deepseek':6A,25A,31B,42B,146B,184C 'deepseek-ai':145B 'deepseek-har':30B 'deepseek-harness':24A 'default':83B 'develop':45B 'dsh':8A,33B,44B,186C 'egress':141B 'email':96B 'everi':106B 'execut':14A,192C,200C 'fake':103B 'file':120B,201C 'first':72B 'fix':172B 'har':7A,32B,43B,185C 'harness':26A 'host':41B,63B 'inherit':61B 'inject':38B,92B 'later':107B 'legitim':205C 'linux':168B 'live':125B 'long':124B 'long-liv':123B 'maco':170B 'master':164B 'mcp':34B,48B,113B 'model':77B 'modules/.bin':70B 'name':53B,154B 'network':140B 'node':69B 'npx':56B,104B 'open':198C 'page':95B 'path':4A,64B,74B,182C 'place':203C 'plant':101B 'pnpm':35B,66B 'poc':159B 'preview':46B 'process':60B,126B 'prompt':37B 'prompt-inject':36B 'public':161B 'publish':178B 'reconnect':110B 'repo':99B 'research':143B,157B 'restrict':139B 'run':116B 'sandbox':87B,136B 'say':144B 'search':3A,181C 'secret':133B 'self':40B 'self-host':39B 'server':49B,114B,129B 'sourc':67B 'spawn':155B 'start':47B,108B 'steer':90B 'suppli':196C 'ticket':97B 'tool':29B,131B 'untrust':2A,180C 'verifi':162B 'version':175B 'via':17A,195C 'web':94B 'workspac':85B 'workspace-writ':84B 'write':79B,86B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-95182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95182","severity":null,"published_at":"2026-10-16T15:17:36+00:00","modified_at":"2026-10-16T19:56:15+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95182:150","url":null,"severity":null,"published_at":"2026-10-23T22:00:47+00:00","modified_at":"2026-10-23T22:00:47+00:00","first_seen_at":"2026-10-23T22:00:47+00:00","fetched_at":"2026-10-23T22:00:47+00:00","note":"No vendor advisory or fix found; sourced from the researcher's gist, PoC repo and two secondary write-ups. Affects dsh master commit c291e796 (Sept 2026), unfixed as of 2026-10-16. The 10.0 score is the CNA/aggregator one and the 'AV:N, no interaction' vector is generous, since exploitation needs prompt injection. No exploitation reported. Related: CVE-2026-95183 (compaction injection), a sibling signal."}],"documents":[{"id":1266,"url":"https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32","title":"Researcher write-up CVE-2026-95182 (gist, NVD-referenced)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1267,"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-95182","title":"Researcher PoC repo for CVE-2026-95182","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1268,"url":"https://al-ice.ai/posts/2026/10/deepseek-harness-cve-2026-95182-95183-search-path-compaction-october-2026/","title":"al-ice.ai: DeepSeek Harness search-path RCE and compaction injection","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1269,"url":"https://vibevulns.com/issues/cve-2026-95182-deepseek-harness-mcp-spawn-path-hijack/","title":"vibevulns: DeepSeek Harness planted fake npx","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}