DeepSeek Harness CVE-2026-82533 Fix

DeepSeek Harness CVE-2026-82533 is a version check

DeepSeek Harness CVE-2026-82533 affects builds before 0.1.2-alpha.1. The local control-plane trusted a client-supplied Host header instead of the TCP peer. A sandboxed agent on the same machine could raise its own session to danger-full-access and turn approval prompts off. If that HTTP port was reachable beyond the laptop, the same interface allowed unauthenticated control and conversation export. NVD records it as CWE-807; VulnCheck scored CVSS 9.4.

This independent portal is not the vendor and this page is not a reproduction guide. The operator question is narrower: which build is actually running, and is it past the published fix line?

The floor is 0.1.2-alpha.1, not “whatever is newest”

• Affected: DeepSeek Harness before 0.1.2-alpha.1 (NVD)
• Fix tag: 0.1.2-alpha.1 on GitHub, 27 Aug 2026; OX Research retested that tag on 30 Aug 2026
• npm lag: Public reporting said 0.1.2-alpha.1 stayed on GitHub, and 0.1.2-alpha.2 (30 Aug 2026) was the first registry build carrying the fix
• CVE published: 8 Sep 2026
• Later previews: 0.1.5 RC and 0.1.6-alpha.2 (17 Sep 2026) are newer tags. They are not a substitute for reading the version you launched

npx @deepseek-ai/dsh web does not prove you crossed that floor. A cached tarball is the usual way to “upgrade” and still be on 0.1.1-rc.2 or earlier. Read the version the process prints, then match it to GitHub Releases. If the string is older than 0.1.2-alpha.1, stop using that tree for real workspaces until you move.

Registry installs should not stop on the GitHub-only tag. If npm is how you launch, prefer 0.1.2-alpha.2 or any later published build, then confirm the running process — not the README badge.

What changed, without a how-to

Fixed builds drop the old “Host header means localhost” check. Startup prints a one-time token; the browser exchanges it for a signed cookie; control-plane calls need that cookie. If a build still accepts those calls with only a spoofable Host and no token step, you are not on the fix line.

Do not hunt for a shell one-liner. Upstream’s own preview notice already says sandboxing and approval prompts are not a guarantee. The CVE is why a pre-0.1.2-alpha.1 default was worse than that warning.

Keep the Web UI on the machine

Current docs start the Web UI at http://127.0.0.1:3080. Binding a wider address, or an SSH / IDE forward you forgot, is the exposure path the write-ups described. Close the forward. Do not publish 3080 to a LAN or a cloud security group and call it a convenience.

Port already in use is a different article: npx failures and port 3080. That decision tree does not patch CVE-2026-82533.

A plugin checklist is not this patch

Plugin security checklist asks whether a community Cordis package can spawn a shell or leave the workspace. CVE-2026-82533 is the product control-plane before 0.1.2-alpha.1, on a default install, with no extra plugin. Unloading skins does not move you onto the fix tag.

After the version is past the floor, still review plugins on a disposable folder and open Trajectory once. That is hygiene, not the remediation. The observability intro is the place to read the log; it does not list affected versions.

Ten-minute operator pass

1. Stop assuming npx means latest. Read the version the running process prints.
2. If it is older than 0.1.2-alpha.1, upgrade before the next real repository. From the registry, do not treat the GitHub-only alpha.1 tag as the package you will get.
3. Confirm the UI is on 127.0.0.1, not a forgotten forward. Launch notes stay on the install page and the npx quickstart.
4. Leave the preview labeled as a preview. 0.1.6-alpha.2 adds a Plugins page and file-change cards; it is still Pre-release, not GA. Feature notes for the previous RC live in What’s New in 0.1.5.
5. Pin the build you verified in the same note as plugin SHAs. A Trajectory from a vulnerable tarball is a poor bug template.

What this article is not

• Not a proof-of-concept and not a scanner signature list.
• Not the community plugin checklist — that remains plugin security.
• Not a second 0.1.5 feature tour, and not DeepSeek API pricing.
• Not a claim that any preview is production-certified. Upstream still warns that compatibility will break.

Where to go next

1. Affected range and the fix tag: NVD CVE-2026-82533 and GitHub Releases.
2. Run a known build: install → npx quickstart.
3. After it is past the floor: modes, then the plugin checklist — in that order.