# DeepSeek vulnerabilities Source: https://junglewise.ai/threats/vendors/deepseek Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/deepseek.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in DeepSeek: 0 in the last 7 days and 10 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-82033, was published on 4 November 2026. 7 vulnerabilities in the last four weeks, up 600% on the four before (1). 2 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 10 - All time: 11 (2 critical, 0 exploited in the wild) ## About DeepSeek Chinese artificial intelligence company developing large language models and AI assistants. ## Latest DeepSeek vulnerabilities - [CVE-2026-82033: DeepSeek Harness auth bypass in web RPC control plane](https://junglewise.ai/threats/cve-2026-82033-deepseek-harness-prior-to-0-1-2-alpha-2-and-specifically-commit) (high, CVSS 8.4, published 4 Nov 2026) - [CVE-2026-120204: DeepInfer path traversal in /profile endpoint](https://junglewise.ai/threats/cve-2026-120204-deepinfer-through-0-1-0-contains-a-path-traversal-vulnerability) (medium, CVSS 5.6, published 31 Oct 2026) - [CVE-2026-116368: DeepSeek Harness improper authorization in browser auth](https://junglewise.ai/threats/cve-2026-116368-a-vulnerability-was-determined-in-deepseek-harness-up-to-0-2-0) (high, CVSS 7.3, published 26 Oct 2026) - [CVE-2026-116367: DeepSeek Harness sandbox issue in createContext](https://junglewise.ai/threats/cve-2026-116367-a-vulnerability-was-found-in-deepseek-harness-up-to-0-1-0-rc-5) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-95183: DeepSeek Harness prompt injection via context-compaction](https://junglewise.ai/threats/cve-2026-95183-an-issue-in-the-context-compaction-feature-of-deepseek-harness) (info, published 16 Oct 2026) - [CVE-2026-95182: DeepSeek Harness untrusted search path code execution](https://junglewise.ai/threats/cve-2026-95182-an-untrusted-search-path-in-deepseek-harness-dsh-commit-c291e796) (critical, CVSS 10, published 16 Oct 2026) - [CVE-2026-52394: DeepSeek V4 incorrect access control in chat interface](https://junglewise.ai/threats/cve-2026-52394-deepseek-v4-is-vulnerable-to-incorrect-access-control-via-a) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-101102: DeepSeek deepseek-harness sandbox isolation issue in Code Mode](https://junglewise.ai/threats/cve-2026-101102-a-vulnerability-was-found-in-deepseek-ai-deepseek-harness-up-to) (medium, CVSS 6.3, published 28 Sep 2026) - [CVE-2026-75858: CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution) (high, CVSS 7.8, published 4 Sep 2026) - [CVE-2026-75912: CodeWhale git_blame argument injection allows arbitrary file read](https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read) (high, CVSS 7.4, published 4 Sep 2026) - [CVE-2025-63872: DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated…](https://junglewise.ai/threats/cve-2025-63872-deepseek-v3-2-has-a-cross-site-scripting-xss-vulnerability-which) (medium, CVSS 6.1, published 2 Dec 2025) ## Most severe DeepSeek vulnerabilities - [CVE-2026-95182: DeepSeek Harness untrusted search path code execution](https://junglewise.ai/threats/cve-2026-95182-an-untrusted-search-path-in-deepseek-harness-dsh-commit-c291e796) (critical, CVSS 10, published 16 Oct 2026) - [CVE-2026-52394: DeepSeek V4 incorrect access control in chat interface](https://junglewise.ai/threats/cve-2026-52394-deepseek-v4-is-vulnerable-to-incorrect-access-control-via-a) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-82033: DeepSeek Harness auth bypass in web RPC control plane](https://junglewise.ai/threats/cve-2026-82033-deepseek-harness-prior-to-0-1-2-alpha-2-and-specifically-commit) (high, CVSS 8.4, published 4 Nov 2026) - [CVE-2026-75858: CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution) (high, CVSS 7.8, published 4 Sep 2026) - [CVE-2026-75912: CodeWhale git_blame argument injection allows arbitrary file read](https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read) (high, CVSS 7.4, published 4 Sep 2026) - [CVE-2026-116368: DeepSeek Harness improper authorization in browser auth](https://junglewise.ai/threats/cve-2026-116368-a-vulnerability-was-determined-in-deepseek-harness-up-to-0-2-0) (high, CVSS 7.3, published 26 Oct 2026) - [CVE-2026-116367: DeepSeek Harness sandbox issue in createContext](https://junglewise.ai/threats/cve-2026-116367-a-vulnerability-was-found-in-deepseek-harness-up-to-0-1-0-rc-5) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-101102: DeepSeek deepseek-harness sandbox isolation issue in Code Mode](https://junglewise.ai/threats/cve-2026-101102-a-vulnerability-was-found-in-deepseek-ai-deepseek-harness-up-to) (medium, CVSS 6.3, published 28 Sep 2026) - [CVE-2025-63872: DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated…](https://junglewise.ai/threats/cve-2025-63872-deepseek-v3-2-has-a-cross-site-scripting-xss-vulnerability-which) (medium, CVSS 6.1, published 2 Dec 2025) - [CVE-2026-120204: DeepInfer path traversal in /profile endpoint](https://junglewise.ai/threats/cve-2026-120204-deepinfer-through-0-1-0-contains-a-path-traversal-vulnerability) (medium, CVSS 5.6, published 31 Oct 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 600% on the four before (1). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## DeepSeek technologies - [DeepSeek Harness](https://junglewise.ai/threats/technologies/deepseek-harness-1): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "DeepSeek vulnerabilities", https://junglewise.ai/threats/vendors/deepseek, 13 November 2026.