CVE-2026-95182

CVE-2026-95182 is an untrusted search path flaw (CWE-426) in DeepSeek Harness (dsh) at commit c291e796. An attacker can supply and cause the program to open crafted executable files in place of legitimate content, which the description says results in arbitrary code execution. The published CVSS 3.1 score is 10.0 (critical), with network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability with changed scope. Only that named commit is identified as affected; no broader version range is given. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat DeepSeek Harness (dsh) at commit c291e796 as vulnerable to arbitrary code execution via an untrusted search path. Do not run it where untrusted files or directories can be placed on its executable search path, and move to a later commit or release only after the vendor confirms the search-path issue is fixed. Until then, restrict who can write files the tool may open and review hosts for unexpected executables loaded in place of legitimate components.