DeepSeek Harness Vulnerability and Self‑Hosting Guide for shell.online

Description and use

DeepSeek Harness had a Host header trust flaw enabling sandbox escape. shell.online now offers a self‑hosting guide that splits the service into a Cloudflare Workers relay and an optional accounts app. The critical setting is TRUST_PROXY=0 to avoid trusting X‑Forwarded‑For unless behind a trusted proxy.

Problem

DeepSeek Harness allowed sandbox escape via Host header trust flaw, exposing unconfined agent commands.

Outcome

Users can now safely self‑host shell.online, avoiding the DeepSeek Harness vulnerability and correctly configuring header trust.

Workflow

• 1. Clone shell.online repo. 2. Deploy relay: copy wrangler.example.jsonc to wrangler.local.jsonc, run wrangler deploy. 3. Point CLI to relay with shell --server https://example.workers.dev or SHELL_ONLINE_SERVER. 4. For accounts app, run docker compose up --build -d in app/. 5. Configure RELAY_URL, SHELL_ONLINE_ACCOUNTS, SHELL_ONLINE_WEB. 6. Set TRUST_PROXY=0 in .env.example unless behind trusted proxy. 7. Verify rate limiting uses CF-Connecting-IP and headers are ignored unless proxy trusted.

Evidence

The harness hands the agent's shell the address of its own local API and the current session id. So the escape was one curl from inside the sandbox to the harness's session-update endpoint, with a Host header of 127.0.0.1

Source

The guide splits shell.online into two services. The relay serves the public site and carries encrypted terminal frames. The accounts app in app/ is optional, adds sign-in, organizations, linked machines and the shared session list, and the CLI does not need it.

Source

TRUST_PROXY=0 is the line to get right before the app is reachable from anywhere but localhost.

Source