CVE-2026-95182

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute…

Risk score: 74/100
CVSS: 10.0 v3.1
Exploit chance (30 days): 0.5%
Published: 16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Amber

CVSS 10.0 critical
Remotely exploitable without logging in

References

http://deepseek.com
https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32
https://github.com/lkloliver/poc/tree/main/CVE-2026-95182

Original description

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

Last activity 16 Oct 2026. Patch Forecast updates every hour.