[GHSA-8m2g-8cgm-3vcp] DeepSeek Harness before 0.1.2-alpha.1 contains an...

[portyu9]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Source code location
• Summary

Comments
Add the missing npm package mapping, affected/patched version information, summary, form-safe CVSS 4.0 vector, and source code location for CVE-2026-82533 / GHSA-8m2g-8cgm-3vcp.

The affected package is @deepseek-ai/dsh-client-connection. The upstream package manifest at packages/client/connection/package.json identifies this as a public npm package. The vulnerable dsh-v0.1.1-rc.2 tag contains version 0.1.1-rc.2, while the fixed dsh-v0.1.2-alpha.1 tag contains version 0.1.2-alpha.1.

Before the fix, the Connection package used the client-supplied Host header as the principal trust decision for the HTTP control-plane boundary. The /api route accepted requests after isTrustedApiRequest() validated the Host/Origin trust fence, but there was no independent browser authentication layer. A caller able to supply a trusted-looking Host value could therefore reach control-plane RPC methods without credentials.

Upstream commit deepseek-ai/deepseek-harness@3e24087 adds process-token and persistent browser-cookie authentication to the Connection service and applies it to the Host API. The fix includes dedicated regression coverage in packages/client/connection/tests/browser-auth.host.spec.ts and apps/cli/tests/web-auth.e2e.ts; the latter explicitly verifies that a forged loopback Host without authentication receives HTTP 401.

Affected package: @deepseek-ai/dsh-client-connection
Affected versions: < 0.1.2-alpha.1
Patched version: 0.1.2-alpha.1

Vulnerable source:
https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/api-request-trust.ts#L96-L108

Fixed release:
https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1

[advisory-database]

Hi @portyu9! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!