CVE-2026-101132

Name of the Vulnerable Software and Affected Versions DeepSeek deepseek-harness versions prior to 0.1.7-rc.2

Description A path traversal flaw exists in the Bundle Patch Handler component. A remote attacker can manipulate the dsh.bundle.patch argument within the loadProfile() function located in the packages/boot/app-boot/src/profile.ts file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations Update DeepSeek deepseek-harness to a version later than 0.1.7-rc.2. As a temporary workaround, restrict access to the loadProfile() function to minimize the risk of exploitation.