---
id: "CVE-2026-95182"
kind: "vulnerability"
aliases: ["CVE-2026-95182"]
title: "An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "deepseek-harness", "fixed": [], "affected": "master commit c291e796 (2026-09) and possibly later; developer preview", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ai-tooling", "deepseek-harness", "dsh", "mcp", "pnpm", "prompt-injection", "self-hosted"]
not_affected_if: ["absolute-mcp-command-paths", "no-workspace-write", "not-source-checkout"]
published_at: "2026-10-16T15:17:36+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95182", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:00:47+00:00"}]
---

# An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via…

DeepSeek Harness (dsh, developer preview) starts MCP servers by bare command name, such as npx, and the child process inherits the host PATH. In pnpm source checkouts node_modules/.bin comes first on PATH, and the model can write there under the default workspace-write sandbox. An agent steered by injected content (web page, email, ticket, cloned repo) can plant a fake npx there. Every later start or reconnect of that MCP server then runs the attacker's file as a long-lived process with the server's tools and secrets, and the sandbox does not restrict network egress. The researcher says @deepseek-ai/dsh-sandbox-local has the same bare-name spawn. The researcher's PoC is public. Verified through master commit c291e796 on Linux and macOS. No fixed commit or version has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:deepseek-harness affected master commit c291e796 (2026-09) and possibly later; developer preview fixed ?

## How to check

You are exposed if you run dsh from a source checkout at or after c291e796 with MCP servers configured by bare command (command: npx) and the agent can write to the workspace. Look in your dsh MCP config for non-absolute command values. Run ls -la node_modules/.bin and look for launchers you did not install or that changed recently. Check git log for the commit you run.

## Fix

No fix published yet. Mitigate now: set MCP server commands to absolute paths. Keep node_modules/.bin out of the model's writable paths. Do not let dsh read untrusted content while it can write to the workspace. Restrict egress. Watch deepseek-ai/deepseek-harness for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95182
- 2026-10-23T22:00:47+00:00 analyst — No vendor advisory or fix found; sourced from the researcher's gist, PoC repo and two secondary write-ups. Affects dsh master commit c291e796 (Sept 2026), unfixed as of 2026-10-16. The 10.0 score is the CNA/aggregator one and the 'AV:N, no interaction' vector is generous, since exploitation needs prompt injection. No exploitation reported. Related: CVE-2026-95183 (compaction injection), a sibling signal.

## Documents

- [advisory] Researcher write-up CVE-2026-95182 (gist, NVD-referenced) https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32
- [describes] al-ice.ai: DeepSeek Harness search-path RCE and compaction injection https://al-ice.ai/posts/2026/10/deepseek-harness-cve-2026-95182-95183-search-path-compaction-october-2026/
- [mitigation] vibevulns: DeepSeek Harness planted fake npx https://vibevulns.com/issues/cve-2026-95182-deepseek-harness-mcp-spawn-path-hijack/
- [poc] Researcher PoC repo for CVE-2026-95182 https://github.com/lkloliver/poc/tree/main/CVE-2026-95182

## From the sources

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_