CVE-2026-108789

Name of the Vulnerable Software and Affected Versions deepseek-ai deepseek-harness versions prior to 0.1.1-rc.2

Description A remote manipulation of the agent() function within the dsh-workflow-worker-thread component allows for the enforcement of a behavioral workflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the agent() function in the dsh-workflow-worker-thread component.