QiAnXin Discloses Critical Remote-Code-Execution Flaw in DeepSeek Harness

QiAnXin Threat Intelligence Center has revealed a critical remote-code-execution vulnerability in DeepSeek Harness, tracked as QVD-2026-57410, with a CVSS 3.0 score of 9.8. The vulnerability arises from the platform's failure to validate the HTTP Host request header, affecting version 0.1.1-rc.2. DeepSeek Harness, launched as an open-source agent platform in mid-August, has gained significant developer interest. This flaw allows attackers to exploit the system without credentials, posing a severe risk. By manipulating the Host header, attackers can bypass security measures and execute arbitrary commands on the target server.