2026-10-13-deepseek-harness-cve-2026-101131-alleges-an-e2b-setup-trust-problem-in-a-retired-component

CVE-2026-101131 alleges an E2B setup trust problem in a retired component. A new advisory alleges locally influenced E2B_API_KEY can affect a trusted sandbox-setup decision in an old implementation. Reading the key does not prove key exfiltration or a practical bypass. The component had already been retired before publication; the detailed submission did not supply accessible confirming evidence.

Channel: docs-only publication about older prereleases; current rc omits the E2B component. Half: defect. Date: 2026-09-28T18:30:14Z (CVE); GHSA at 21:31:16Z.

Operator consequence: Identify any old E2B-backed deployments and treat the migration away from that removed backend separately from the disclosure. Do not invent a September 28 fix, a current-rc exposure, or key exfiltration. An accessible detailed report and affected/fixed mapping would settle those questions.

Receipt

• https://github.com/CVEProject/cvelistV5/blob/a16e0dce460042963be9c343d261234166097f54/cves/2026/101xxx/CVE-2026-101131.json
• https://github.com/advisories/GHSA-vcc3-4jvw-qx89
• https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.3/packages/e2b/e2b/src/index.ts#L93-L106
• https://github.com/deepseek-ai/deepseek-harness/commit/c49db8bc8c2924e115308692d34af7539288e7bb