CVE-2026-101132 Overview
CVE-2026-101132 is a path traversal vulnerability [CWE-22] in DeepSeek deepseek-harness through version 0.1.7-rc.2. The flaw resides in the loadProfile function within packages/boot/app-boot/src/profile.ts, part of the Bundle Patch Handler component. Attackers can manipulate the dsh.bundle.patch argument to traverse directories outside the intended bundle path. The attack is remote but requires user interaction and high complexity to exploit. The vendor was contacted before disclosure but did not respond, and a public exploit has been released.
Critical Impact
Successful exploitation permits limited unauthorized read access to files outside the intended bundle directory through crafted patch paths.
Affected Products
- DeepSeek deepseek-harness versions up to and including 0.1.7-rc.2
- Bundle Patch Handler component (packages/boot/app-boot/src/profile.ts)
- Deployments exposing the loadProfile function to untrusted dsh.bundle.patch input
Discovery Timeline
- 2026-09-28 - CVE CVE-2026-101132 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-101132
Vulnerability Analysis
The vulnerability originates in the loadProfile function of profile.ts, which processes the dsh.bundle.patch argument when handling bundle patches. The function fails to sanitize or canonicalize path segments before resolving the patch location on disk. An attacker who supplies traversal sequences such as ../ in the dsh.bundle.patch value can escape the intended bundle directory. The attack vector is network-based, but exploitation requires user interaction and a high attacker skill level, limiting the practical scope. The public exploit release nonetheless raises the risk for exposed deployments, particularly where automated tooling forwards untrusted bundle metadata to the harness.
Root Cause
The root cause is missing path normalization and directory containment checks within loadProfile. User-controlled input flows directly into filesystem resolution APIs without verifying that the resulting path remains within the expected bundle root. This maps to [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
An attacker crafts a bundle patch reference whose dsh.bundle.patch value contains directory traversal characters. When the harness invokes loadProfile, the manipulated path resolves to a location outside the bundle directory, allowing read access to arbitrary files the harness process can access. Because exploitation requires user interaction and high complexity, mass exploitation is unlikely, but targeted attacks against known deployments remain feasible.
No verified proof-of-concept code is published in the referenced sources. See the GitHub Discussion on Deepseek Harness and the VulDB CVE-2026-101132 Entry for technical context.
Detection Methods for CVE-2026-101132
Indicators of Compromise
- Requests or bundle manifests containing dsh.bundle.patch values with ../, encoded traversal sequences (%2e%2e%2f), or absolute filesystem paths
- Unexpected file read events from the deepseek-harness process targeting files outside the bundle directory
- Errors or stack traces from loadProfile referencing paths outside packages/boot/app-boot
Detection Strategies
- Instrument the loadProfile code path with logging that records the resolved absolute path of every patch load
- Compare resolved paths against the expected bundle root and alert on any path that escapes it
- Inspect application logs and reverse proxy access logs for suspicious dsh.bundle.patch parameter values
Monitoring Recommendations
- Monitor filesystem access by the harness process using auditd, eBPF, or equivalent host telemetry
- Alert on read attempts targeting sensitive files such as /etc/passwd, SSH keys, or application secrets from the harness process
- Track deployment of deepseek-harness versions across the environment to identify unpatched hosts
How to Mitigate CVE-2026-101132
Immediate Actions Required
- Restrict network exposure of any service that accepts dsh.bundle.patch input from untrusted sources
- Validate and canonicalize all bundle patch paths at the ingress layer before they reach loadProfile
- Audit historical logs for suspicious dsh.bundle.patch values that indicate prior exploitation attempts
Patch Information
No vendor patch is referenced in the available advisories. The vendor was contacted prior to disclosure but did not respond. Track the GitHub Discussion on Deepseek Harness for updates and monitor the VulDB Vulnerability #410989 entry for revised remediation guidance.
Workarounds
- Wrap loadProfile calls with a resolver that rejects any path containing .., null bytes, or absolute path prefixes
- Run the harness process under a least-privilege user account with filesystem access limited to the bundle directory
- Apply mandatory access controls (AppArmor, SELinux) or container filesystem policies to confine reads to the intended bundle root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
