CVE-2026-101132 Details
Description
A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A path traversal vulnerability has been identified in DeepSeek Harness versions through 0.1.7-rc.2. The issue arises in the Bundle Patch Handler component, specifically within the loadProfile function of profile.ts. The vulnerability allows for manipulation of the dsh.bundle.patch argument, enabling attackers to traverse directories and access files outside the intended bundle package directory. This vulnerability can be exploited remotely, but requires a high level of complexity.
Users are advised to update to DeepSeek Harness versions later than 0.1.7-rc.2, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/deepseek-ai/deepseek-harness/discussions/3354 | [email protected] | ExploitTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-101132 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/938664 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/410989 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/410989/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DeepSeek Harness | <= 0.1.0-rc.5 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | New CVE Received | [email protected] |