Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Finding / deepseek-harness

2026-10-13-deepseek-harness-cve-2026-108788-publishes-an-older-spawn-profile-allegation-with-an-unresolved-mechanism

CVE-2026-108788 publishes an older spawn-profile allegation with an unresolved mechanism. A CVE/GHSA publication alleges a locally influenced launch Profile can bypass sandbox restrictions in versions through 0.1.1-rc.2. It does not establish that the current rc is affected or fixed, and this pass did not obtain a reproducible mechanism.

Channel: docs-only; older prereleases through 0.1.1-rc.2. Half: defect. Date: 2026-10-12T02:00:56Z (CVE); GHSA at 03:32:55Z.

Operator consequence: Keep the disclosure in the inventory for old deployments. Request an accessible reproducer and fixing-commit/containing-tag evidence before treating any current version as vulnerable or repaired on this basis.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-deepseek-harness-cve-2026-108788-publishes-an-older-spawn-profile-allegation-with-an-unresolved-mechanism

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. DeepSeek Harness
    commit pinned cve record2026-10-13-deepseek-harness-cve-2026-108788-publishes-an-older-spawn-profile-allegation-with-an-unresolved-mechanismCVEProject/cvelistV5 / cves/2026/108xxx/CVE-2026-108788.jsoncanonical advisory2026-10-13-deepseek-harness-cve-2026-108788-publishes-an-older-spawn-profile-allegation-with-an-unresolved-mechanismgithub.com/advisories/GHSA-5mvr-2xwh-9v9q