CVE-2026-95182

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

CVSS v3.1 CISA-ADP

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2026-10-16

Proof-of-concept exploits (1)

• lkloliver/poc/tree/main/CVE-2026-951820★ · 2026-10-14

References

• CVE Record
• NVD entry

Related

• CVE-2025-65865
• CVE-2025-67111
• CVE-2026-88755
• CVE-2026-95210