Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-model
CVE-2026-101102 documents the older Code Mode host-user trust model. The new record concerns an old Code Mode implementation whose own documentation gave generated code the harness user’s file/process rights. The current rc uses a different, separate-process PTC architecture. Neither publication nor replacement establishes an unauthenticated remote exploit or vendor-certified CVE-specific fix.
Channel: docs-only publication; separate-process replacement is on current rc. Half: both. Date: 2026-09-28T18:00:07Z (CVE); GHSA at 18:31:26Z.
Operator consequence: Inventory old run_code deployments and move evaluations to the current rc architecture. Preserve the distinction between an architectural replacement and an assigned fixed version; require a vendor mapping or reproducer before calling this CVE fixed.
Receipt
- https://github.com/CVEProject/cvelistV5/blob/f9975a22f71be782aff19e6fac192da4b9ca5613/cves/2026/101xxx/CVE-2026-101102.json
- https://github.com/advisories/GHSA-m9ww-cpfc-8cf2
- https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.0-rc.7/packages/code-runtime/code-runtime-worker-thread/README.md#L5
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/ptc-runtime/ptc-runtime-node/README.md#L62-L74
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-model
Profile citations
- deepseek-harness / claim / cve-code-mode-publication
Source links
Primary links, including exact changelog lines when available.
- commit pinned cve record2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-modelCVEProject/cvelistV5 / cves/2026/101xxx/CVE-2026-101102.jsoncanonical advisory2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-modelgithub.com/advisories/GHSA-m9ww-cpfc-8cf2tagged commit file2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-modeldeepseek-ai/deepseek-harness / packages/code-runtime/code-runtime-worker-thread/README.md#L5tagged commit file2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-modeldeepseek-ai/deepseek-harness / packages/ptc-runtime/ptc-runtime-node/README.md#L62-L74
Versioned source: run artifact