CVE-2026-101132

LOW 3.1

DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-22
Vendor	deepseek
Product	deepseek-harness
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for deepseek deepseek-harness

Be the first to know when new low vulnerabilities affecting deepseek deepseek-harness are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

DeepSeek / deepseek-harness

0.1.7-rc.0 0.1.7-rc.1 0.1.7-rc.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410989 vuldb.com: https://vuldb.com/vuln/410989/cti vuldb.com: https://vuldb.com/cve/CVE-2026-101132 vuldb.com: https://vuldb.com/submit/938664 github.com: https://github.com/deepseek-ai/deepseek-harness/discussions/3354

Credits

🔍 rockmelodeis (VulDB User) VulDB CNA Team