Threats tagged 'ghsa-rh7q-h525-wx9f'

A path traversal vulnerability exists in DeepSeek deepseek-harness versions 0.1.7-rc.0, 0.1.7-rc.1, and 0.1.7-rc.2. The issue is in the loadProfile function of the Bundle Patch Handler component, allowing remote attackers to manipulate the dsh.bundle.patch argument to perform path traversal. Exploitation is difficult and requires a high level of complexity. The vendor has not responded to the disclosure, and no patch or fix is currently available. Public exploit code has been released, but no known active exploitation in the wild is reported. The CVSS 4.0 base score is 2.3, indicating low severity.