2026-10-13-deepseek-harness-cve-2026-101102-documents-the-older-code-mode-host-user-trust-model

CVE-2026-101102 documents the older Code Mode host-user trust model. The new record concerns an old Code Mode implementation whose own documentation gave generated code the harness user’s file/process rights. The current rc uses a different, separate-process PTC architecture. Neither publication nor replacement establishes an unauthenticated remote exploit or vendor-certified CVE-specific fix.

Channel: docs-only publication; separate-process replacement is on current rc. Half: both. Date: 2026-09-28T18:00:07Z (CVE); GHSA at 18:31:26Z.

Operator consequence: Inventory old run_code deployments and move evaluations to the current rc architecture. Preserve the distinction between an architectural replacement and an assigned fixed version; require a vendor mapping or reproducer before calling this CVE fixed.

Receipt

• https://github.com/CVEProject/cvelistV5/blob/f9975a22f71be782aff19e6fac192da4b9ca5613/cves/2026/101xxx/CVE-2026-101102.json
• https://github.com/advisories/GHSA-m9ww-cpfc-8cf2
• https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.0-rc.7/packages/code-runtime/code-runtime-worker-thread/README.md#L5
• https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/ptc-runtime/ptc-runtime-node/README.md#L62-L74