CVE-2026-95182

Published: Oct 16, 2026Modified: Oct 16, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

Related CWEs

CWE-426

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (3)

http://deepseek.com

Source: cve@mitre.org

https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32

Source: cve@mitre.org

https://github.com/lkloliver/poc/tree/main/CVE-2026-95182

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.