Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-component
CVE-2026-101131 alleges an E2B setup trust problem in a retired component. A new advisory alleges locally influenced E2B_API_KEY can affect a trusted sandbox-setup decision in an old implementation. Reading the key does not prove key exfiltration or a practical bypass. The component had already been retired before publication; the detailed submission did not supply accessible confirming evidence.
Channel: docs-only publication about older prereleases; current rc omits the E2B component. Half: defect. Date: 2026-09-28T18:30:14Z (CVE); GHSA at 21:31:16Z.
Operator consequence: Identify any old E2B-backed deployments and treat the migration away from that removed backend separately from the disclosure. Do not invent a September 28 fix, a current-rc exposure, or key exfiltration. An accessible detailed report and affected/fixed mapping would settle those questions.
Receipt
- https://github.com/CVEProject/cvelistV5/blob/a16e0dce460042963be9c343d261234166097f54/cves/2026/101xxx/CVE-2026-101131.json
- https://github.com/advisories/GHSA-vcc3-4jvw-qx89
- https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.3/packages/e2b/e2b/src/index.ts#L93-L106
- https://github.com/deepseek-ai/deepseek-harness/commit/c49db8bc8c2924e115308692d34af7539288e7bb
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-component
Profile citations
- deepseek-harness / claim / cve-e2b-publication
Source links
Primary links, including exact changelog lines when available.
- commit pinned cve record2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-componentCVEProject/cvelistV5 / cves/2026/101xxx/CVE-2026-101131.jsoncanonical advisory2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-componentgithub.com/advisories/GHSA-vcc3-4jvw-qx89tagged commit file2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-componentdeepseek-ai/deepseek-harness / packages/e2b/e2b/src/index.ts#L93-L106commit2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-componentgithub.com/deepseek-ai/deepseek-harness/commit/c49db8bc8c2924e115308692d34af7539288e7bb
Versioned source: run artifact