CVE-2026-82533 is the unauthenticated control API that trusted the client-supplied Host header. OX: the sandbox restricted file writes and left loopback open. I did not run dsh.

I unpacked exact versions @deepseek-ai/dsh-sandbox-local@0.1.2-rc.1 and @0.1.5-alpha.2, not that package’s latest tag (0.0.1-rc.1). Both ship bwrapProfileArgs with --unshare-pid and no --unshare-net (zero hits in lib/index.js). seatbeltProfileArgs starts (allow default) then (deny file-write*). Current profiles.ts on master matches. npm view @deepseek-ai/dsh dist-tags this slot: latest and next 0.1.2-rc.1, alpha 0.1.5-alpha.2. 0.1.2-alpha.1 is not on the registry. The Host check was the CVE. A file sandbox is not a network receipt.