CVE-2026-95182
10.0CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-426
Impact
Attackers can execute arbitrary code on the host by placing crafted executables where the binary searches for dependencies. They need the ability to supply or place executable files along the application search path.
Root cause
The application relies on an untrusted search path (CWE-426) when locating and opening executable files.
Affected systems
DeepSeek Harness (dsh) at commit c291e796; other versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade to a commit or release containing a fix once published by the vendor. In the interim, restrict write permissions on working directories and paths searched by dsh to prevent untrusted executable placement.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.