Untrusted Search Path in DeepSeek Harness

Executive Summary

CVE-2026-95182 is an Untrusted Search Path vulnerability in DeepSeek Harness (dsh) developer preview. It allows attackers to execute arbitrary code by replacing legitimate executables with malicious ones in writable directories like node_modules/.bin. The issue occurs because dsh spawns MCP servers using unqualified command names, inheriting the host's PATH environment variable. An attacker can plant a malicious executable with the same name as a legitimate command, which dsh will execute instead when spawning or reconnecting to MCP servers.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected executables in writable directories like node_modules/.bin. Inspect PATH environment variables for suspicious entries. Monitor MCP server spawns for unusual command executions or reconnect retries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables persistent, infrastructure-level compromise. Attackers can gain long-lived access to MCP servers with the operator's credentials and permissions. The hijacked process can expose tools to agent sessions without detection. The attack requires no user interaction and can be triggered by external content like web pages or emails. It allows unrestricted network access and remains invisible to both users and models.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution with elevated permissions, potentially exposing sensitive data. This may violate GDPR's data protection principles (e.g., integrity, confidentiality) and HIPAA's security requirements for protected health information if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using pnpm source-checkout deployments. Use fully qualified command paths in MCP configurations. Restrict write permissions in node_modules/.bin. Implement a unified executor-resolution layer to prevent bare-name spawns.

Useful 0 Not Useful 0