Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containment
CVE-2026-101132 names bundle patch traversal; current rc and alpha lack path containment. The advisory publication identifies a bundle-patch traversal problem. Current code still lets an installed bundle select a patch file outside its package and compose it if its content parses as valid configuration. This is not proof of unrestricted disclosure of arbitrary files or a pre-auth network endpoint. No fixed tag was established.
Channel: docs-only publication; source-confirmed check gap persists in preview rc and alpha. Half: defect. Date: 2026-09-28T18:45:08Z (CVE); GHSA at 21:31:16Z.
Operator consequence: Review each bundle’s patch paths and the selected files, not just its package name. Reject unexpected paths escaping the package. A containment check with tests and an identified containing release would settle the open fix question.
Receipt
- https://github.com/CVEProject/cvelistV5/blob/f9975a22f71be782aff19e6fac192da4b9ca5613/cves/2026/101xxx/CVE-2026-101132.json
- https://github.com/advisories/GHSA-rh7q-h525-wx9f
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/boot/app-boot/src/profile.ts#L58-L75
- https://github.com/deepseek-ai/deepseek-harness/blob/d743267388641bc76f17c45ce8b4c231aed1d32c/packages/boot/app-boot/src/profile.ts#L58-L75
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containment
Profile citations
- deepseek-harness / claim / bundle-patch-path-containment
- deepseek-harness / claim / cve-bundle-traversal-publication
Source links
Primary links, including exact changelog lines when available.
- commit pinned cve record2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containmentCVEProject/cvelistV5 / cves/2026/101xxx/CVE-2026-101132.jsoncanonical advisory2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containmentgithub.com/advisories/GHSA-rh7q-h525-wx9ftagged commit file2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containmentdeepseek-ai/deepseek-harness / packages/boot/app-boot/src/profile.ts#L58-L75tagged commit file2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containmentdeepseek-ai/deepseek-harness / packages/boot/app-boot/src/profile.ts#L58-L75
Versioned source: run artifact