Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

Fix availableCritical · CVSS 9.4EPSS 1.2%

Published Sep 8, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: @deepseek-ai/dsh-client-connection 0.1.2-alpha.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@deepseek-ai/dsh-client-connection

Vulnerable versions
< 0.1.2-alpha.1
Fixed in
0.1.2-alpha.1

Check your project: npm ls @deepseek-ai/dsh-client-connection --all

Is @deepseek-ai/dsh-client-connection@0.1.2-alpha.1 safe to install? See the upgrade verdict →

Sources

CWE-807 Reliance on Untrusted Inputs in a Security Decision

← All critical vulnerabilities