External risk intelligence

DeepSeek Harness Code Execution via Untrusted Search Path

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-95182

DeepSeek Harness (dsh) is a developer-centric tool used for building or testing software. The vulnerability requires an attacker to convince a user to open a crafted executable file within the tool, which is a local, developer-controlled activity rather than a public-facing network service or internet-accessible application.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue in DeepSeek Harness could allow an attacker to run unauthorized code by tricking a user into opening a malicious file within the tool. This could impact the integrity and availability of operations if the tool is used in critical workflows. The primary concern is to confirm if this tool is in use and if exposure is possible.

Malicious files can execute code in the tool.
Confirms tool usage and potential exposure.
Verify relevance and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into opening a specially crafted executable file. This file, when processed by DeepSeek Harness, could be used to run arbitrary code on the user's system.

No authentication required.
Opening a crafted executable.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on a system running DeepSeek Harness when a user opens a specially crafted executable file. The impact depends on the privileges of the running process and the attacker's ability to trick a user into opening the malicious file.

Arbitrary code execution.
User opens crafted executable.
System compromise or data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

The DeepSeek Harness (dsh) vulnerability, which allows for arbitrary code execution through crafted executable files, is likely to impact development or testing environments. The first practical step involves identifying all instances of dsh, confirming their reachability and criticality, and then determining the accountable owner for remediation planning based on the assessed risk.

Application development and platform teams own the issue.
Verify dsh deployment and its exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DeepSeek Harness?

DeepSeek Harness (dsh) is a developer-centric software utility. Engineers and testers use it to build, manage, or validate code workflows. It functions as a local environment tool rather than a public-facing network service, typically integrated into development or testing infrastructure to streamline technical tasks.

What does CVE-2026-95182 mean for code security?

This vulnerability is classified as an Untrusted Search Path (CWE-426) issue. In simple terms, the software looks for files in locations that an attacker might control. Because the program incorrectly trusts these paths, it may accidentally load and run a malicious file instead of a legitimate one, granting the attacker the ability to execute unauthorized code.

How is this vulnerability triggered?

An attacker must successfully trick a user into opening a specifically crafted executable file within the DeepSeek Harness environment. The bug is not triggered by simply having the software installed or by an automated network attack; it requires the active, manual step of a user interacting with the malicious file.

Is my system at risk?

According to Halo Surface Signal, this is very unlikely for most systems. The vulnerability requires local user interaction, making it a developer-focused concern rather than a remote, internet-facing threat. You should be most concerned if your team uses dsh in environments where external, untrusted files are frequently processed or opened.

What should I do first to manage this risk?

Begin by auditing your development and testing environments to locate all instances of DeepSeek Harness. Once identified, confirm which teams own these tools and assess whether they handle files from untrusted sources. Use this inventory to prioritize which environments require updates or restricted file-handling policies.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.