CVE-2026-95182

critical

Description

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

References

https://github.com/lkloliver/poc/tree/main/CVE-2026-95182

https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102903

http://deepseek.com

Details

Source: Mitre, NVD

Published: 2026-10-16

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H