{"id":"CVE-2026-95182","title":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","summary":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"adp","ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:12:09.702708Z"},"exploitAvailable":true,"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:13:19.214Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-95182","references":[{"url":"http://deepseek.com"},{"url":"https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-16T15:11:47.125Z","slug":"CVE-2026-95182","body":"## Overview\n\nAn untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":223087,"id":"CVE-2026-95182","ts":1792172092409,"field":"exploit_available","old":"false","new":"true"},{"seq":223086,"id":"CVE-2026-95182","ts":1792172092409,"field":"cvss","old":null,"new":"10"},{"seq":223085,"id":"CVE-2026-95182","ts":1792172092409,"field":"severity","old":"none","new":"critical"}]}