All vulnerabilities
CVE-2026-82533GHSA-8m2g-8cgm-3vcp

@deepseek-ai/dsh-client-connection: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

DeepSeek @deepseek-ai/dsh-client-connectionnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.24%Chance of exploitation activity in the next 30 days, higher than 68% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.2-alpha.1Fixed versionGitHub
Published8 Sep 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.1.2-alpha.1@deepseek-ai/dsh-client-connection, npmGitHubnpm install @deepseek-ai/dsh-client-connection@0.1.2-alpha.1
  • 0.1.2-alpha.1DeepSeek HarnessCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin. Attackers can exploit this flaw to invoke privileged commands such as commands/execute with danger-full-access permissions, escalate session approval policies to unconfined execution, and retrieve all stored conversations without any credential or API key.

Text from CVE List

Affected versions 3

  • @deepseek-ai/dsh-client-connection, npm< 0.1.2-alpha.1GitHub
  • DeepSeek Harnessaffected: all versions before 0.1.2-alpha.1CVE List
  • @deepseek-ai/dsh-client-connection, npmfrom first release, fixed in 0.1.2-alpha.1OSV

References 7