2026-10-13-deepseek-harness-cve-2026-101132-names-bundle-patch-traversal-current-rc-and-alpha-lack-path-containment

CVE-2026-101132 names bundle patch traversal; current rc and alpha lack path containment. The advisory publication identifies a bundle-patch traversal problem. Current code still lets an installed bundle select a patch file outside its package and compose it if its content parses as valid configuration. This is not proof of unrestricted disclosure of arbitrary files or a pre-auth network endpoint. No fixed tag was established.

Channel: docs-only publication; source-confirmed check gap persists in preview rc and alpha. Half: defect. Date: 2026-09-28T18:45:08Z (CVE); GHSA at 21:31:16Z.

Operator consequence: Review each bundle’s patch paths and the selected files, not just its package name. Reject unexpected paths escaping the package. A containment check with tests and an identified containing release would settle the open fix question.

Receipt

• https://github.com/CVEProject/cvelistV5/blob/f9975a22f71be782aff19e6fac192da4b9ca5613/cves/2026/101xxx/CVE-2026-101132.json
• https://github.com/advisories/GHSA-rh7q-h525-wx9f
• https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/packages/boot/app-boot/src/profile.ts#L58-L75
• https://github.com/deepseek-ai/deepseek-harness/blob/d743267388641bc76f17c45ce8b4c231aed1d32c/packages/boot/app-boot/src/profile.ts#L58-L75