Threats tagged 'ghsa-vcc3-4jvw-qx89'

A vulnerability in deepseek-ai deepseek-harness up to version 0.1.5-rc.3 allows local attackers to manipulate the E2B_API_KEY argument, causing reliance on untrusted inputs in a security decision. The issue affects an unknown function in the file packages/e2b/e2b/src/index.ts of the dsh component. Exploit code is publicly available. The vendor has not responded to disclosure attempts. The vulnerability has a low severity score of 3.3 CVSS and requires local access for exploitation.