CVE-2026-101131
Received Received - Intake

Remote Code Execution in DeepSeek Harness via E2B API Key

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2B_API_KEY leads to reliance on untrusted inputs in a security decision. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101131
EUVD
EUVD-2026-88404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
deepseek-ai deepseek-harness to 0.1.5-rc.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in deepseek-ai deepseek-harness up to version 0.1.5-rc.3. It involves a file named packages/e2b/e2b/src/index.ts where the argument E2B_API_KEY can be manipulated. This leads to a situation where the system relies on untrusted inputs for security decisions. An attacker needs local access to exploit this issue. A public exploit is available, and the vendor did not respond to early disclosure.

Detection Guidance

This vulnerability requires local access and involves manipulation of the E2B_API_KEY argument in deepseek-harness. Detection may involve checking for unauthorized environment variable modifications or unusual API key usage in logs. No specific commands are provided in the context.

Impact Analysis

Since the vulnerability allows manipulation of a security-critical input (E2B_API_KEY), an attacker with local access could potentially alter how the system makes security decisions. This might lead to unauthorized actions or data exposure, depending on the system's configuration and usage of the affected component.

Compliance Impact

The vulnerability involves reliance on untrusted inputs in a security decision due to manipulation of the E2B_API_KEY argument. This could potentially lead to unauthorized access or data exposure if exploited, which may impact compliance with standards like GDPR (data protection) or HIPAA (healthcare data privacy) by compromising confidentiality or integrity of sensitive data.

Mitigation Strategies

Immediate steps include removing or updating the vulnerable deepseek-harness component to a patched version. Restrict local access to systems running this software and audit environment variables for suspicious E2B_API_KEY configurations. Monitor for unusual API key usage or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101131. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart