CVE-2026-95182

Summary

An untrusted search path vulnerability in DeepSeek Harness allows attackers to execute arbitrary code by replacing legitimate files with malicious executables, potentially leading to full system compromise.

Exploitability

Exploitation is relatively straightforward requiring only that an attacker can place a crafted executable in a location that dsh will execute, with no privileged access required and minimal user interaction needed.

Blast radius

The impact could be severe across all systems running the affected version of DeepSeek Harness, potentially allowing attackers to gain complete control over those systems through arbitrary code execution.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to commit c291e796 or later which contains the fix for the untrusted search path vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.