{"action":"Upgrade @deepseek-ai/dsh-client-connection to 0.1.2-alpha.1 or later.","affected":[{"fixed":"0.1.2-alpha.1","introduced":"0"}],"component":"@deepseek-ai/dsh-client-connection","cve_ids":["CVE-2026-82533"],"ecosystem":"npm","epss":0.01238,"exploited":false,"fixed_versions":["0.1.2-alpha.1"],"ghsa_id":"GHSA-8m2g-8cgm-3vcp","id":"tcs_01M5KFDCDKH1MWJ9C5DD2KNYSH","modified_at":"2026-10-07T21:00:04.349245572Z","published_at":"2026-09-08T18:32:01Z","references":["https://osv.dev/vulnerability/GHSA-8m2g-8cgm-3vcp","https://nvd.nist.gov/vuln/detail/CVE-2026-82533","https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27","https://github.com/deepseek-ai/deepseek-harness","https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1","https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape","https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-8m2g-8cgm-3vcp","url":"https://osv.dev/vulnerability/GHSA-8m2g-8cgm-3vcp"}],"summary":"DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API"}