Threats tagged 'ghsa-h3m7-c9pq-7995'

DeepSeek Harness versions prior to 0.1.2-alpha.2, specifically commit 3e24087, have a missing authentication vulnerability in the web profile HTTP and WebSocket RPC control plane. This flaw allows any local process, including those running under different OS users, to access unauthenticated session methods such as session.create and session.prompt. Exploitation enables attackers to execute arbitrary commands as the victim user, intercept live session traffic and logs, and bypass human tool-approval checks.